Small Models Also Found the Vulnerabilities that Mythos Found

Key Takeaways

• Small open‑weight models detected Mythos's FreeBSD exploit
• 3.6B‑parameter model costs $0.11 per million tokens
• 5.1B model uncovered 27‑year‑old OpenBSD bug chain
• Smaller models show higher false‑positive rates than Mythos
• Human researchers missed vulnerabilities found by AI models

Pulse Analysis

Artificial intelligence is rapidly becoming a core tool in cybersecurity, with large models like Anthropic's Mythos demonstrating the ability to not only locate but also chain together complex software flaws. Mythos’s recent showcase highlighted a sophisticated FreeBSD exploit and a decades‑old OpenBSD bug, positioning it as a near‑autonomous threat hunter. However, the latest community experiment reveals that even modest, open‑weight models—some with just a few billion parameters—can replicate much of Mythos’s detection capability when fed isolated code snippets, challenging the notion that only massive, proprietary systems can perform high‑level vulnerability analysis.

The cost implications are striking. A 3.6 billion‑parameter model runs at roughly $0.11 per million tokens, orders of magnitude cheaper than commercial offerings, while a 5.1 billion‑parameter model still undercuts the expense of proprietary alternatives. This affordability opens the door for smaller firms and academic labs to incorporate AI‑driven code review into their security pipelines. Yet the trade‑off is a higher false‑positive rate and an inability to automatically generate working exploits, meaning human expertise remains essential to validate findings and translate them into actionable patches or defensive measures.

For the broader industry, these insights suggest a hybrid approach will dominate: inexpensive models for rapid, broad‑scope scanning, followed by expert analysis to filter noise, and finally, high‑capacity models like Mythos for deep exploitation pathways. As AI continues to democratize vulnerability research, organizations must invest in both tooling and skilled personnel to stay ahead of adversaries who can leverage the same technology for offensive purposes. The evolving landscape underscores the importance of integrating AI responsibly while maintaining rigorous human oversight.