Cloudflare tests Mythos against 50+ of its repositories, highlights its ability to chain bugs into one exploit, and details its vulnerability discovery harness
Earlier coverage positioned Mythos as a general-purpose system capable of finding high-severity flaws across widely used software, while later reports describe its use in enterprise security testing and government-code audits. Cloudflare adds a repository-scale evaluation and a repeatable vulnerability-discovery harness to that arc.
The important progression is from isolated vulnerability findings to evidence that the system can connect multiple weaknesses into a usable exploit path. That makes the practical value—and the defensive urgency—less about identifying individual bugs alone.
First-order effects
Cloudflare can use its harness and testing results to prioritize remediation of multi-step attack paths across the repositories it evaluated, rather than treating discovered flaws as independent issues.
Mythos’s demonstrated bug-chaining capability raises the severity of combinations of otherwise separate vulnerabilities, increasing pressure on software owners to validate exploitability during triage.
Second-order effects
Security teams adopting similar model-driven testing will need workflows for reviewing, reproducing, and fixing a potentially larger volume of findings; token costs and human validation capacity become operational constraints.
Vendors and public-sector code owners using Mythos face a faster race between defensive discovery and attackers’ ability to turn known or newly found weaknesses into working exploit chains.
Third-order effects
If repository-scale, AI-assisted exploit-path discovery proves repeatable, vulnerability management may shift from CVE-by-CVE remediation toward continuous testing of how flaws compose across codebases and dependencies.
The same capability could make secure development practices and coordinated disclosure more consequential, because the time available to address connected weaknesses may compress; the extent depends on reliability and access controls around these systems.
The trend: Mythos is part of a broader shift from AI-assisted bug finding toward automated, end-to-end security testing that identifies and validates exploitable chains of weaknesses.
This, 1M% this: “The principle is to make exploitation harder for an attacker even when a bug exists, so that the gap between when a vulnerability is disclosed and when it is patched matters less. That means defenses that sit in front of the application and block the bug from
i read it and thought these 2 main points were interesting: 1. Mythos vs other frontier models - Frontier models could find a lot of the individual bugs, but a lot of cyber attacks use multiple small bugs chained together. Frontier models weren't that good at piecing these smal…
“Well, the great researchers are submitting world class reports assisted by AI at an even greater pace, and the less skilled researchers are polluting the triage queue with genuinely unimportant vulnerability reports”😉
This is the kind of conversation we need, not idiotic ones about the end of all software... it can't just be patching the 100 or so projects that got access to Project Glasswing. That is not gonna help the world... In the long run, AI will make software more secure, not less. B…
Reading this, the bun rewrite to rust makes much more sense. My guess: Mythos looked at bun and had a shit fit - generated a deluge of vulnerabilities and memory bugs so vast and profound that they would be effectively impossible to fix in zig. Anthropic looked at the report an…
I'm preaching you need to sprint to do the basics and do them well to help defend against AIs like Mythos. This is crap we should have done 20 years ago, but ran to the “next-gen” products thinking it would save us.
Great write-up from @cloudflare on how they chain Mythos agents together into a useful harness. A lot of lessons in there apply well beyond just vulnerability scanning. The adversarial review by other agents (and models) works great on code investigations and reviews too.
Nice write up from the Cloudflare team, but the post here is misleading. Patch faster is not the wrong answer, because most teams are patching on the order of weeks or months. You must patch faster than that right now. But I will agree that 2 hours is infeasible beyond the
It's really funny watching companies learn things like patching at high velocity isn't a cybersecurity silver bullet The state of cybersecurity is so bad in tech today, they're recreating defense in depth from first principles
Amazing post. Giving LLM's narrow tasks, and composing those as lego blocks gives much better results than “just ask the model”. great example of what the lego blocks & composition look like for a security scanner.
A must read. One thought: Does AI flip the OSS security tradeoff? OSS was pitched as more “good eyeballs” on your code, catching bugs before “bad eyeballs” do. But now devs get eyeballs from AI. Maybe closed source makes sense, to starve the bad eyeballs. @thegrugq @ImposeCost
Mythos and other frontier models, pointed at live code across critical Cloudflare infrastructure. An honest read on what's working and what comes next. https://blog.cloudflare.com/ ...
“Mythos Preview is a real step forward, and it's worth saying that plainly before getting into anything else. We've been running models against our code for a while now, and the jump from what was possible with previous general-purpose frontier models to what Mythos Preview does
Cloudflare is right about this. You're not going to be able to patch fast enough, but you can build your systems so that the vast majority of vulnerabilities don't matter. If you've not done that, you're going to have a bad time. [image]
Cloudflare's security team spent the last few weeks testing Anthropic's Mythos against fifty of our own repositories. What we learned about offensive AI, why faster patching is the wrong reaction, and what the architecture around vulnerabilities has to look like next.
AI has officially entered its “Senior Security Researcher” era. Cloudflare's security team recently spent weeks testing Anthropic's new Mythos Preview against 50+ of their own code repositories. …
“Anthropic has agreed to brief leading finance ministries and central banks on vulnerabilities in the global financial system's cyber defences identified by the US technology company's latest AI model.”