Project Glasswing: what Mythos showed us (opens in new tab)

Project Glasswing found that Anthropic’s Mythos Preview represents a major advance in AI-assisted vulnerability research. Unlike conventional scanners, it can combine multiple low-level bugs into a credible exploit chain and generate working proofs by writing, compiling, and testing code iteratively. However, inconsistent refusals and a high rate of speculative findings mean capable models still require strong safeguards and human-led validation before large-scale deployment.

Exploit Chain Construction

• Mythos Preview can combine several seemingly minor vulnerabilities into a complete attack.
• It can reason from primitives such as use-after-free bugs to arbitrary read/write access, control-flow hijacking, and ROP-based system takeover.
• Earlier frontier models often identified individual bugs but failed to connect them into a working exploit.
• This ability can elevate low-severity findings that might otherwise remain ignored in vulnerability backlogs.

Automated Proof Generation

• The model does more than describe suspected vulnerabilities:
  • Writes proof-of-concept code.
  • Compiles it in a scratch environment.
  • Executes it and checks whether the expected behavior occurs.
  • Revises its hypothesis when testing fails.
• This feedback loop distinguishes plausible speculation from demonstrated exploitability.

Inconsistent Model Refusals

• Mythos Preview lacked the additional safeguards used in generally available models, but still developed emergent refusals around some offensive security tasks.
• These refusals were inconsistent:
  • The same research task could succeed after an unrelated environmental change.
  • The model might confirm serious memory bugs but refuse to create an exploit.
  • Rephrasing the request or repeating it could produce a different result.
• Organic model guardrails are therefore not reliable enough to act as a complete safety boundary.
• Future publicly available cyber-capable models will need additional, deliberate safeguards beyond their learned behavior.

The Signal-to-Noise Problem

• Vulnerability research still requires determining which findings are real, exploitable, and urgent.
• AI tools increase the volume of speculative findings, making triage more difficult.
• Two major factors affect noise levels:
  • Programming language: C and C++ expose developers to memory bugs such as buffer overflows and out-of-bounds access, while memory-safe languages such as Rust eliminate many of these classes at compile time. Memory-unsafe projects produced more false positives.
  • Model bias: Models tend to report possible vulnerabilities even when evidence is weak, using qualifications such as “possibly” or “could in theory.”
• Exploratory over-reporting may help discover novel issues, but it is costly in a production triage queue because each speculative finding consumes analyst time and model resources.

Scaling AI-Assisted Security Research

• Mythos Preview’s capabilities justify treating it as a different class of security tool rather than simply a better conventional scanner.
• Scaling these systems will require:
  • Post-validation stages to filter speculative findings.
  • Sandboxed environments for compiling and testing proofs.
  • Human review of exploit chains and severity.
  • Explicit safety controls that do not depend solely on model refusals.
• The main challenge is no longer only whether models can find vulnerabilities, but whether organizations can reliably validate, prioritize, and safely manage their output.

Organizations should use advanced security models in controlled environments with layered safeguards and rigorous validation. Their ability to construct exploits is powerful, but their inconsistent safety behavior and noisy findings make unsupervised use inappropriate.