Cybersecurity industry pushes back on Anthropic's Mythos vulnerability-hunting claims

Anthropic Mythos is quickly drawing skepticism as well as interest. The model is being discussed for its ability to find dangerous cyber vulnerabilities, but it may not be as unique as its public presentation suggests. If Aisle's internal test results hold up, the high-profile case that alarmed government agencies and large organizations can also be reproduced on far cheaper open-source models.

The debate started with claims that Mythos can identify software defects and vulnerabilities at a level that pushed government agencies and institutional customers to take the risks of such a tool more seriously. The fact that only a limited group of companies is testing the model adds to the tension: with access to the system closed, the market has to rely on individual demonstrations and the developer's own assessments rather than broad benchmarks. That is where Jaya Baloo, COO and CISO of cybersecurity company Aisle, raised her key criticism.

She said her team reproduced the same result Anthropic cited in internal tests, using inexpensive open-source models. In other words, this may not be an unreachable technological leap by one closed system, but a task that more accessible tools can already handle with the right configuration, enough context, and well-crafted prompts. For buyers and regulators, the difference is huge.

A rare model with tightly controlled access that produces an unusual result in a closed environment is one thing. Cheaper systems that deliver a comparable effect and can be deployed in-house or used with open-source code are another. In the first case, the focus is on restricting access to a specific product.

In the second, organizations will have to rethink their security processes, code review, and internal testing as part of a new normal. There is another important layer to this story: how much to trust bold claims made early in testing. While the model is being evaluated by a limited group of companies, the public market sees only the tip of the picture — a single case, a striking claim, and the reaction to it.

A real assessment requires comparable scenarios, reproducible results, and an understanding of the conditions under which the model found a specific vulnerability. Without that, it is easy to mistake an impressive demo for a durable advantage. For the cybersecurity industry, this is a fundamental point.

If Mythos's uniqueness is overstated, the threat assessment changes too. Concerns about such models rest on two premises: they speed up vulnerability discovery and lower the barrier to entry for attackers. But if the same effect is achievable through the open-source ecosystem, the discussion should shift from a single company to a broader fact: these capabilities are likely already spread across the market and not tied to one vendor.

On the other hand, this does not necessarily ease the alarm — if anything, it makes it more practical. For governments, corporations, and developers, the question is no longer only how powerful one flagship AI is, but how quickly similar capabilities are spreading to low-budget and publicly available models. Closed access to Mythos may have created a sense of exclusive danger.

Aisle's claim points to a different scenario: bug-hunting capabilities that help defenders, and are just as risky in attackers' hands, are already going mainstream. The main takeaway is that the dispute over Anthropic Mythos is not only about the quality of one model, but also about how the market measures AI exceptionalism in cybersecurity. If cheap open-source solutions really do find the same vulnerabilities, Anthropic's competitive edge looks less dramatic, and the discussion moves from sensation to verification, comparative testing, and controlling access to such tools.