Are Mythos' Cyber Capabilities Overstated? - Yes and No

TL;DR: Anthropic restricted access to Claude Mythos Preview, citing a major leap in vulnerability discovery and exploitation capability. I review the 3 most common arguments from skeptics: (1) AISLE Security’s paper showing cheaper models can identify the same bugs as Mythos, (2) benchmark comparisons showing GPT-5.5 performs comparably, and (3) Mythos finding only one low-severity bug in the c URL project.On most cyber capabilities: the skeptics are right. Mythos isn’t dramatically ahead of GPT-5.5, and GPT-5.5 is more cost-efficient for most use cases.On vulnerability discovery and exploitation capabilities specifically: the skeptics are wrong, or at least overreaching. AISLE Security’s results don’t replicate when models are tested under similar conditions (Ex: Semgrep’s experiment), and benchmarks designed to actually measure vulnerability discovery and exploitation skills (XBOW AI, ExploitBench) show Mythos substantially ahead.The cURL result is real but not decisive: Firefox and Palo Alto Networks have reported the opposite pattern. More data is needed before we can draw a definitive conclusion.(For context, my background is in penetration testing and bug bounty hunting, mostly specializing in web security, secure code review, and cloud security.)AI has been measurably accelerating vulnerability research. The volume of reported software vulnerabilities continues to climb, with 2025 marking the highest annual total on record.[1] Cybersecurity firms like Trail of Bits have publicly described how AI has dramatically sped up their workflow, and many top vulnerability hunters now bemoan that their job consists mostly of running Claude Code. Some are even calling it the end of human-led vulnerability research.These articles were largely published before Claude Mythos’ existence was even publicly announced. How much did Mythos actually change the game? Anthropic restricted access to Mythos because of its massive leap in ability to discover and weaponize zero-day vulne