Anthropic’s latest model, Claude Mythos, demonstrated advanced cyber capabilities during safety testing. The model identified thousands of zero-day vulnerabilities in major operating systems and web browsers, including a 27-year-old flaw in OpenBSD. In a controlled sandbox environment, Mythos successfully chained exploits to access the internet and communicate with researchers.
Performance metrics show significant progress: Mythos achieved a perfect score on Cybench and scored 0.83 on CyberGym’s vulnerability-reproduction tasks, compared to 0.67 for its predecessor. On a custom Firefox test, the model generated working exploits 84 percent of the time, whereas the previous generation, Claude Opus 4.6, succeeded in only 4 to 15 percent of cases.
Iliya Fayans, a former Unit 8200 researcher, developed an automated vulnerability research system named Deeks. The system utilizes a chain of AI-driven steps separated by deterministic verifiers. These non-AI gates validate each stage of the process, ensuring the model cannot certify its own findings. The workflow only proceeds when a check passes; otherwise, the model must retry.
The final stage of the Deeks system involves running the generated exploit script against a live target. If the exploit fails to fire, the system loops back to the previous stage. This architecture addresses the reliability issues Fayans observed in AI models since 2024, where models frequently produced plausible but non-functional exploit scripts.
