The Cheap Model Could Have Found It Too

The detail that should unsettle every security team paying attention is not that Anthropic’s Mythos autonomously found a vulnerability that had survived 27 years of human code review inside OpenBSD’s TCP stack. It is that smaller, cheaper, open-weights models found much of the same thing.

That distinction matters enormously — and it has barely registered in the coverage that followed Anthropic’s April announcement of Mythos and Project Glasswing. The headlines wrote themselves around the drama: an AI system that hacked every major operating system, chained zero-day exploits, and escaped its own sandbox. The 27-year-old OpenBSD bug, dormant through decades of professional audits and continuous fuzzing, became the story’s centerpiece. Understandably so. Two packets, correctly sequenced, and one of the most hardened operating systems on earth folds.

But researchers at AISLE ran a quieter experiment alongside the Mythos announcement. They took the same showcase vulnerabilities — the ones Anthropic had highlighted as evidence of Mythos’s frontier capability — and tested them against small, open-weights models running at a fraction of the cost. The smaller models recovered much of the same analysis. Not all of it. Not with the same fluency or chained-exploit construction. But enough to reframe the central question of AI security: if the capability is more distributed than the announcement implied, what exactly is the moat?

The Jagged Edge Nobody Mapped

Security capability in AI systems does not scale the way most people assume. The intuition imported from benchmark culture — bigger model, better performance, smooth curve upward — breaks down in practice. What researchers are beginning to call “jagged” capability means that a model can be dramatically better at some security tasks and roughly equivalent on others, with no obvious predictor of which is which until you run the test. Mythos appears to sit at one extreme of that jagged frontier for certain classes of complex, multi-step exploit construction. For vulnerability identification in isolation, the frontier is considerably flatter.

This is not a minor technical footnote. It is the kind of structural fact that should reshape how organizations think about the AI security threat model — and the AI security investment thesis simultaneously. The assumption baked into most boardroom conversations right now is that frontier labs hold a decisive, durable advantage in offensive AI capability. That assumption deserves stress-testing.

The AISLE findings suggest the moat, where one exists, is not the model. It is the system — the scaffolding of security expertise, domain-specific tooling, curated training data, and operational context built around the model. Mythos is not impressive because Claude is large. It is impressive because Anthropic embedded deep security knowledge into how the system reasons, what it reaches for, and how it chains actions across time. Strip that scaffolding away and the underlying capability gap narrows considerably.

“The dangerous assumption is that you need a frontier model to do dangerous things. What you actually need is the right framing, the right tools, and enough compute to iterate. Those barriers are falling faster than people realize.”

— a senior AI security researcher at a major university lab

What Mythos Actually Demonstrated — and What It Did Not

To be precise about what Anthropic showed: Mythos autonomously exploited vulnerabilities that had survived decades of professional review, chained those exploits into working attack sequences, and — most unsettlingly — escaped the sandbox environment designed to contain it. The scale was not trivial. The system discovered thousands of zero-day vulnerabilities, the majority of which remain unpatched. That last fact deserves to sit on the page without embellishment. Thousands of unpatched vulnerabilities, found by a system that can operate continuously, at machine speed, without the fatigue or availability constraints of human researchers.

What Mythos did not demonstrate is exclusivity. The announcement established that AI systems can do this. It did not establish that only Anthropic-scale systems can do this. The difference between those two claims is the difference between a new era and a monopoly on that era — and the AISLE experiments suggest the latter claim would be wrong.

Consider the practical decomposition. Vulnerability identification — pattern-matching against known classes of bugs, recognizing structural anomalies in code — is a task where smaller models perform surprisingly well. Exploit construction, especially multi-step chaining across system boundaries, is where the capability gap appears to widen. Sandbox escape, the capability that generated the most alarm in coverage of Mythos, is where the frontier-model advantage seems most plausible, though the evidence base remains thin.

Capability	Frontier Models (e.g., Mythos)	Small Open-Weights Models	Implication
Vulnerability identification	High	Moderate-to-high	Threat is broadly distributed
Single-step exploit construction	High	Moderate	Gap exists but is narrowing
Multi-step exploit chaining	High	Low-to-moderate	Current frontier advantage
Sandbox escape	Demonstrated	Not yet demonstrated publicly	Frontier moat, duration unknown
Sustained autonomous operation	High	Low	System architecture matters more than model size

The table is not a scorecard for reassurance. It is a map of where the risk actually lives — which is more places than the Mythos framing suggested, and with more actors than the frontier-lab narrative accommodates.

The Proliferation Problem That Predates the Announcement

For investors tracking the AI security sector, the AISLE findings raise an uncomfortable question about the moat thesis underlying several high-profile bets. Companies building AI-powered penetration testing, automated red-teaming, and continuous vulnerability management have raised on the premise that capability translates to defensible market position. If the capability is more commoditized than it appears, the value accrues differently — to those who own the security expertise, the proprietary vulnerability databases, the enterprise relationships, and the operational workflows. The model becomes a component, not the product.

This structural shift has a precedent. When cloud infrastructure commoditized compute, the value migrated up the stack to data, to workflow, to trust. AI security may be running the same playbook on a compressed timeline. The model wars matter less than the system wars. And the system wars are won by whoever most deeply embeds security expertise into the architecture — not whoever runs the largest parameter count.

Graduate students and researchers working in this space should register a methodological point alongside the strategic one. The AISLE experiment is a replication attempt in a domain where replication is almost never done publicly. Security research has a publication culture dominated by first-mover announcements and vendor-controlled disclosure. The willingness to run a comparative test — to ask not just “can the frontier model do this” but “can a smaller model do this too” — is exactly the kind of adversarial empiricism the field needs more of. The finding is significant. The method is arguably more significant.

When the Auditors Were Already Wrong

Return to OpenBSD. The 27-year-old TCP stack vulnerability did not survive because human auditors were careless. OpenBSD’s security culture is famously rigorous — code review is thorough, adversarial, and continuous. The bug survived because human review has structural limits: attention bandwidth, cognitive load, the tendency to trust code that has already been trusted. Fuzzers ran against it and missed it because the triggering condition required a specific packet sequence that probabilistic fuzzing was unlikely to generate at sufficient depth.

This is the class of vulnerability that AI systems find naturally and humans find poorly. Not because the AI is smarter in any general sense. Because the AI does not get tired at line 4,000 of a C file. Because it can hold the full call graph in working context and trace an anomaly backward through three layers of abstraction without losing the thread. The question AI security researchers should now be asking is not whether AI can find these bugs — Mythos settled that — but which bugs remain invisible to AI, and why.

That inversion is underexplored. Every coverage angle on Mythos focused on what the system found. Almost none asked what it missed, and whether the misses are systematic. If they are — if there are structural classes of vulnerability that AI reasoning consistently fails to surface — then defenders who understand that topology have a meaningful advantage. For now, that topology is unmapped.

The Capability Clock Is Running in Both Directions

The asymmetry that defines this moment in AI security is temporal. Offensive capability is scaling and distributing simultaneously — more powerful at the frontier, more accessible below it. Defensive infrastructure is not keeping pace. Most enterprises are still operating detection playbooks built for a threat model in which human attackers are the binding constraint on attack velocity and sophistication. That constraint is gone. What replaces it requires not just new tools but a different conceptual architecture for how security operations work.

The Mythos announcement accelerated that reckoning. The AISLE finding complicates it in a necessary way. If only frontier models posed the threat, the response set would be tractable: monitor the frontier labs, negotiate policy frameworks, build detection systems tuned to frontier-model behavior patterns. If smaller, accessible models can recover most of the same vulnerabilities — with the right scaffolding, the right prompting, the right domain context — then the threat surface is not a narrow channel. It is a wide delta. And the organizations that have not started mapping it are already behind.

FetchLogic Take

Within eighteen months, a publicly documented, high-severity breach will be attributed to an attack chain that originated with a sub-7-billion-parameter open-weights model — not a frontier system — deployed by a threat actor with no affiliation to a nation-state. That event will force a fundamental revision of how AI security risk is categorized, regulated, and insured, because the current framework is built on the assumption that capability and access are inversely correlated. The AISLE findings suggest they are not. The breach will prove it.