Anthropic’s Mythos Preview Shows Promise in AI‑Driven Vulnerability Hunting

Anthropic’s Mythos Preview, part of Project Glasswing, was tested on more than fifty internal repositories to evaluate its vulnerability hunting capabilities. Unlike earlier frontier models, Mythos Preview can chain multiple low‑severity primitives into a single exploit chain and automatically generate, compile, and run proof‑of‑concept code, providing concrete evidence of exploitability. The model also demonstrates reasoning steps that resemble a senior researcher, offering clearer reproduction steps and fewer hedged findings compared to generic coding agents.

However, Mythos Preview exhibits inconsistent organic refusals—sometimes rejecting a request to build a PoC and later accepting the same request under a different framing—highlighting the need for additional safeguards before broader deployment. The authors note that the noise rate is still high for memory‑unsafe languages like C/C++, but the higher quality of findings reduces triage effort. They emphasize that a controlled research context is essential until the model’s guardrails are hardened. The study suggests that Mythos Preview’s strengths lie in its exploit‑chain construction and proof generation, while its weaknesses stem from unpredictable refusals and language‑specific false positives. Future work will focus on integrating consistent safety layers and scaling the tool for enterprise‑wide vulnerability analysis.