Application security , AI/ML More Mythos-like models are coming — what organizations can do now July 20, 2026 Share By Laura French (Credit: Robert – stock.adobe.com) Anthropic’s Claude Mythos is only the beginning of a new era of autonomous vulnerability discovery and exploit development, with the underlying capabilities that made Mythos a milestone already beginning to appear elsewhere. New models from U.S. and international developers are beginning to narrow the gap between what is currently guarded by Project Glasswing and what cyber attackers could potentially use to turn this capability against defenders. Anthropic itself has said it expects many other companies to develop Mythos-class models within six to 12 months. Chinese developer Z.ai recently released GLM-5.2 under an open-weight MIT license, which Semgrep researchers found beat Claude Opus, OpenAI’s GPT-5.5 and other open-weight models in Insecure Direct Object Reference (IDOR) detection tasks. Another Chinese company, 360 Security Technology, recently announced a multi-agent system called Tulongfeng, which Founder Zhou Hongyi called “China’s version of Mythos,” according to Forbes . In Japan, Sakana AI announced a multi-model orchestration system called Fugu Ultra , which it claims “stands shoulder-to-shoulder with leading models like Fable 5 and Mythos Preview” in engineering, science and reasoning benchmarks. And last week, OpenAI released its “strongest cybersecurity model yet,” GPT-5.6 , which surpassed Mythos Preview in ExploitBench results and has its greatest defense capabilities restricted behind the OpenAI Daybreak Trusted Access for Cyber program. Semgrep’s blog post sharing results from its testing of GLM-5.2 is titled “We have Mythos at home,” but Semgrep Founder and CEO Isaac Evans emphasized in an email interview with SC Media that open-weight models have not yet caught up to Mythos’ most consequential capabilities. “GLM-5.2 with zero scaffolding beat Claude Code on our IDOR detection benchmark, the first time we’ve seen a knockoff-priced model outpunch a frontier coding agent,” Evans said. “But detection was never the party trick. Mythos’s real flex was exploit generation, turning a hunch into a working, verified exploit at scale. Nothing open-weight is close to that.” The distinction between detecting a potential vulnerability and reliably producing a working exploit is what made Mythos so disruptive to begin with, and why the U.S. government recently sought to restrict access to its latest versions with a now-lifted export control directive. Anthropic has said Mythos can identify and exploit zero-day vulnerabilities across major operating systems and browsers, while the UK AI Security Initiative reported that Mythos became the first model to complete both of its cyber ranges end to end. But defenders may not need to wait for an open model to fully match Mythos before the economics of vulnerability discovery begin to change. Cheaper models can be run repeatedly and paired with stronger scaffolding or combined with other systems, potentially giving a wider range of defenders and attackers access to capabilities that were previously concentrated among a few frontier AI labs. “The biggest swings in our own testing weren’t model versus model, they were bare prompt versus a model wrapped in a decent harness, something that scopes the code and points the model at real attack surfaces instead of just saying ‘find the bugs,’” Evans noted. How open-weight models are beginning to close the gap Semgrep’s benchmark focused on IDORs, a common class of access-control vulnerability in which an application fails to properly verify whether a user is authorized to access a requested object. The company tested GLM-5.2 alongside Claude Code running Opus 4.6, 4.7 and 4.8 and found that GLM-5.2 with a bare prompt outperformed Claude Code at a cost of approximately $0.17 per vulnerability found — about an eighth of the cost of frontier LLMs, Semgrep said. More specifically, GLM-5.2 had an F1 — a score that balances precision and recall — of 39% compared with 37% scored by the highest-performing Claude model, Opus 4.6. However, the highest scores in Semgrep’s tests came from models running in a custom multimodal harness the company developed itself, which enumerates endpoints and directs models to them. With this harness, GPT-5.5 scored an F1 of 61%, and Opus 4.8 an F1 of 53%. “A public Claude model or an open-weight one like GLM 5.2 will both earn their keep today if you build that scaffolding around them,” Evans said. “Run more than one model while you’re at it. Vulnerability hunting rewards diversity over a simple genius in the corner. And don’t ignore cost: a cheap model run 10 times can beat an expensive one run once.” Semgrep cautioned in its blog post that the result represented one run, one dataset and one vulnerability class, and should not be treated as proof that open-weight models have fully caught up to frontier cyber models more broadly. Still, the results show why comparisons based only on a model’s origin, price and access restrictions may quickly become outdated. GLM-5.2 is publicly downloadable and deployable under an MIT license, meaning organizations can run or modify it without depending on a controlled-access program. Evans, whose company also has access to Mythos under Project Glasswing and OpenAI’s latest models under the Trusted Access for Cyber program, said one of the biggest misconceptions about these models is that restricting access means the broader risk is contained. “Open-weight models are closing the gap fast, and gating the frontier doesn’t touch what’s already sitting on a GPU somewhere,” he said. At the same time, Evans said leaderboard results should not be viewed as a complete measure of cyber capability. A model that performs well on vulnerability detection may still struggle to validate a finding, create a reliable proof of concept or move through the stages of a real attack. That limitation separates GLM-5.2’s benchmark result from the more advanced capabilities attributed to Mythos. “GLM found the needle. Mythos built a machine that also threats it, ten thousand times an hour, for cheap,” Evans said. Model restrictions face a diffusion problem The spread of cyber capability across foreign and open-weight models complicates government efforts to restrict access to the most powerful systems. Anthropic has limited Mythos access through Project Glasswing and publicly released its “Mythos-tier” Fable model with strict guardrails on its cyber capabilities. The U.S. government temporarily imposed export restrictions on Mythos and Fable before lifting them after additional safeguards were implemented. OpenAI has taken a tiered-access approach with its own cyber-focused models, through its OpenAI Daybreak program. Restrictions targeting one company or specific models may have a diminishing impact as similar capabilities emerge through foreign labs, open-weight releases, distillation and multi-model orchestrations. For example, Sakana AI specifically highlights in its announcement of Fugu Ultra that the system “delivers frontier capability without the risk of export controls” by orchestrating multiple agents and dynamically rerouting to other models when one is restricted. Srinivas Mukkamala, CEO of Securin, said software and AI capabilities move faster than regulatory systems that were originally designed to govern access to physical technologies, such as advanced chips, can realistically keep pace. “The real problem isn’t whether one model crossed some line — it’s that capability diffuses faster than any control regime can track,” Mukkamala told SC Media. “What’s frontier this month is open-weight in a few weeks.” Mukkamala said governments should place greater emphasis on the systems these models could be used to target, rather than focusing exclusively on who can obtain a particular model. “That means testing critical systems — power grids, hospitals, government networks — the way an attacker actually would, and fixing the real weak points before they’re exploited,” he said. Such efforts are likely underway in the U.S., as Reuters reported that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) began using Mythos to scan government systems for vulnerabilities shortly after export controls on the model were lifted. Mukkamala likens AI model access to the way the Food and Drug Administration (FDA) regulates access to vaccines, where safety comes first but equitable access should also be prioritized. “We didn’t let vaccines stay a luxury item for the few who could afford them — we made access a public good. AI needs the same principle, or we’re going to create a new divide between the haves and have-nots, except this time the gap is intelligence itself,” Mukkamala said. The model ‘race’ distracts from the operational problem For enterprises, tracking which model leads a particular benchmark is less important than building a security program capable of adapting to continued advances across many models. Ronen Shetelboim, chief marketing officer at Cycode, told SC Media organizations risk treating rapid model releases as a “spectator sport” rather than an operational challenge. “Every month brings a new model claiming a new benchmark win, and it’s tempting to wait and see who ‘wins,’” Shetelboim said. Organizations should monitor new releases and understand what emerging models can do, he said, but awareness alone does not amount to a strategy. “What actually matters is whether you have the tools and framework to move at the speed of AI from a defensive perspective: agentic scanning, agentic remediation, and governance over what AI is doing in your pipeline,” Shetelboim said. “The model race is noise. Your ability to keep pace with it is what matters.” Shetelboim recommended that organizations evaluate models according to output quality, efficiency and cost, rather than defaulting to the newest or more expens