Defenders finally have a chance to win, decisively
I’m curious how it will turn out to be in a long term. Are we going to have safer software? Because not only defenders will have a powerful tool, but attackers too. But at the same time, number of bugs is finite… Can we in theory one day achieve literally zero bugs in codebase?
You can achieve zero bugs through liberal use of rm.
You can achieve the same effect with a hammer
deleted by creator
Some LLMs will agree with you
Are we going to have safer software? Because not only defenders will have a powerful tool, but attackers too.
Probably not safer software, but the window of time for a bug being known and exploitable will be shortened greatly. Instead of 0-days, we might have 0-minutes.
That’s assuming these ridiculous AI systems are rolling deployments that fast, so maybe that idea’s nonsense.
It is theoretically possible by using formal verification. Which is getting easier due to lean. But still impractical.
Not zero bugs, but it should help. A benefit for defenders is that they can use AI review on code before they make it public or release it in a stable release
We’ve led the industry in building and adopting Rust
Yeah, then you fired the team to pay the CEO a few million more.
This fluff piece has quite the pie-in-the-sky attitude toward the blue-teaming applications of AI.
Some commentators predict that future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension, but we don’t think so.
How reassuring.
The defects are finite, and we are entering a world where we can finally find them all.
Could’ve said the same thing when enterprise anti-malware came onto the scene decades ago, but the reality was it was just another vector for the arms race between the red team and the blue team. The author seems to put a lot of stock in the whole “the blue team has access to these AI tools that the red team doesn’t currently have access to” argument, which kinda ignores the fact that that reality is simply not going to last.
I could be wrong, but any article suggesting “zero-days are numbered” doesn’t pass the smell test.
I could be wrong, but any article suggesting “zero-days are numbered” doesn’t pass the smell test.
Yeah, you’re right.
The real story is that it is a bit better at finding bugs. Calling them zero-days and implying there’s some major security implications is just to build hype.
It was able to chain a few of the bugs together to create a RCE exploit in a weakened browser, it’s interesting but don’t go to your fallout shelter just yet.
I agree that 0-days aren’t numbered. There are so many layers on which tech can be exploited that this is a difficult claim to make.
On the other hand, there are two different kind of exploits: clear holes in the logic, a situation or code path not considered by the coder. And the much harder to catch extremely creative ways to make a program do things it was never designed to do.
I have not seen LLMs doing creative things ever, so I doubt it would catch this second category. But sure, catching some logic holes it can be helpful with.
How many vulnerabilities would’ve been found if we had spent several million dollars on human security researchers though?
That doesn’t make sense. Don’t the attackers have the same tools?
Mythos Preview is better at finding real vulnerabilities than existing public models and, for now, only a few have access to it.
I’m aware (unfortunately) of the marketing claims and even if they might be true, as you say it is “for now”. So if it’s only temporary for that arm race, especially if held by a company who leaked its own code just days ago, then I have a hard time understanding why ‘zero-days are numbered’ because this title claims the dynamic itself is gone. That’s now my understanding, especially if other models are just marginally (which is hard to prove with models, finding proper metrics) worst than it.
See comment that shared https://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims just few hours ago, and that’s not even sophisticated.
Anthropic and OpenAI have multiple times used this arm race rhetoric before and it worked. Their models are supposedly “too dangerous” to be released thus consequently they have to control access.
It might be true but so far what we have witnessed is that roughly equivalent models get released by others merely weeks or maybe months after, sometimes open, but the “moat” never lasted long so I’m questioning why it would be different this time.
Actually untrue. The only thing mythos added was an automatic way to exploit vulns that other models also find. I read a good article on mastodon about it. I posted it elsewhere in the thread but also here https://www.flyingpenguin.com/the-boy-that-cried-mythos-verification-is-collapsing-trust-in-anthropic/
Not right now, thats the whole thing
