Cybersecurity Looks Like Proof of Work Now

Why It Matters

Enterprises must now budget for large‑scale token consumption to stay ahead of AI‑driven attackers, reshaping cybersecurity economics. The shift could accelerate adoption of token‑funded audits and change how software security is prioritized.

Key Takeaways

• Anthropic's Mythos completed a 32‑step attack simulation, others did not
• Each 100 M token run costs about $12,500
• No diminishing returns observed up to 100 M tokens
• Security may become a token‑spending race akin to proof‑of‑work
• Open‑source software security could improve with token‑funded audits

Pulse Analysis

Anthropic’s Mythos model has sparked a fresh debate in cybersecurity by demonstrating a tangible edge over its peers. In a controlled evaluation by the AI Security Institute, Mythos tackled "The Last Ones," a 32‑step corporate network attack simulation that typically requires 20 hours of human effort. Across ten runs, each consuming 100 million tokens—about $12,500 per attempt—Mythos succeeded three times, while models like Opus 4.6 and GPT‑5.4 fell short. The report highlighted a linear relationship between token spend and exploit discovery, with no sign of diminishing returns at the tested budget ceiling.

The economics of this capability echo the proof‑of‑work model that underpins many cryptocurrencies: success hinges on raw computational—or token—investment rather than cleverness. For defenders, the equation flips; they must out‑spend potential attackers to uncover vulnerabilities before they are weaponized. This creates a new budgeting imperative where security teams allocate substantial token resources to continuous, automated red‑team exercises. The lack of diminishing returns suggests that, at least for now, throwing more tokens yields proportionally more exploit findings, making token spend a decisive factor in risk mitigation strategies.

Practically, the shift could accelerate three‑phase development pipelines: rapid feature creation, AI‑assisted code review, and token‑driven hardening. Open‑source software, long championed for its transparency, may benefit from token‑funded audits that scale with usage popularity, aligning with Linus’s law extended to token economics. Companies might invest in dedicated AI security budgets, treating token consumption as a measurable security metric, while the broader industry watches for cost‑efficiency breakthroughs that could eventually introduce diminishing returns and reshape the token‑spending arms race.