Anyone in my profession worth a damn will tell you the vast majority of security issues are related to bad configurations and bad practices + accidents and bad luck. Vulnerable software is a problem but basic defense in depth will either mitigate or drastically reduce attack surface. Mythos does nothing to change that.

The technical debt at companies is the largest security threat. That, and layer 8 which is the people factor. The amount of silliness I've seen from people and companies as a whole is truly hard to verbalize. I've seen banks that gave every employee from the janitor up to the CEO domain admin access due to a crappy application that was written in 2004 that they never updated. I've seen a fortune 250 company write its own internal routing protocol that was basically clear text traffic that dated back to the 1990's and was never retired because, why not. I've seen contractors infect entire fab's in the chip industry because they plugged an infected USB stick into a 30 year old tool that hadn't seen an update in over 20. Then when the fab came back up, they did it again the next day.

Ultimately, Mythos is just another tool in the toolbox. It's great to find new vulns but it is incredibly short sighted to think it will move the needle in any meaningful way in the security industry.

This will establish an asymmetry where the chosen organizations get to secure their stuff and break other people’s systems with each new model release.

If you believe the “good guys” will be the ones given asymmetric offensive access, then you’re either severely misinformed or support things like ethnic cleansing (which these models are already being used for).

Mythos’ slightly higher performance is a nothing burger. It is not even the current top model. According to anthropic, gpt 5.5 is!

Personally, I’m switching to open weight models asap, and probably will start sending money to Chinese vendors since they have values more compatible with western democracy.