upvote
> There's also a runaway effect of model improvement from the discovery, triage and fix data. This is likely already the most potent corpus of curated offensive data ever assembled and will only get better.

But that corpus of data is accessible to all competitors, American or not. I don't believe that this can't be replicated. I'd posit that there's enough annotated data out there (CVE+patch), only increasing thanks to Mythos, that if you specifically RL for this scenario, you can improve your models performance on finding vulnerabilities without access to Mythos.

reply
the CVE + patch data has been built into models for a few generations now. I actually thought the bug bounty companies were well positioned here, but they've been overtaken.

Mythos is a better hacker than we ever were

reply
I don't see why they couldn't contract out to an American security firm that has access?
reply
Surely it's forbidden by the agreement with Anthropic
reply
> This is why I believe mythos will remain private for the foreseeable future. There's such a large surface that needs to be secured and so much to triage, fix, deploy.

sigh I remember the GPT-2 days - when it was the first time OpenAI restricted access to the models citing "humanity is not ready for it". The model was good at writing poetry or something.

Since then, I don't remember a single model announcement from OAI/ANT that didn't use similar wording.

The so-called leak of model announcement was marketing, it being dangerous is marketing, the world not being ready for it is marketing. And yes, the ones that were given access to saying "oh wow", believe or not, is also marketing.

It's all marketing. You can get the same results from any of the top-5/10 models that are generally available already.

Mythos is Anthropic's way to sell the new idea, because the previous one has democratized.

reply
Writing marketing 10 times doesn't invalidate the (many) claims from many respectable sources that the model is a step change in cybersec. There's also the report [1] from the Brits that track cyber capabilities since '22 or '23 and they've also confirmed it's a step change (together with 5.5 cyber or whatever they call it).

Marketing is like propaganda. It doesn't need to be based on false facts. Of course they're gonna milk it, keep it private and so on. But that doesn't mean the model is bad. Or that others are as good (apparently they're not there yet).

[1] - https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5...

reply
Please don't misrepresent the article it says clearly "a step up in cyber performance over previous frontier models" and that gpt-5.5 is on their tests is slightly better than mythos.
reply
Scroll to the graph labeled "Completed steps..."

If that doesn't convince you that both mythos and 5.5 are a step up (several steps, hah) nothing will.

reply
It’s still not clear to me that humanity was ready for GPT-2! Quite a lot of people claim to hate and fear LLMs. https://www.kcl.ac.uk/news/one-in-five-britons-think-ai-will... or https://yougov.com/en-us/articles/54762-most-americans-say-a... for example.
reply
I think you just aren't reading the post, or any of the Glasswing partner's posts. You have this view in your head of what Mythos is, and nobody can say anything dissuade you from it.
reply
"Partners" is the important word in your comment. I am reading all of it, but I have a huge barrel of salt to consume along with everything that I read, because I see conflicts of interest everywhere I go, with fancy words and no means to verify.

If I was given free access to any frontier model to use on my projects, equivalent of millions of dollars in AI credits, I sure hope people didn't trust anything that came out of my mouth until they were able to verify my claims themselves.

AI industry has even resulted in a new term - benchmaxing - which essentially means we can't even trust the data anymore until we can touch the model ourselves. So this is not at all surprising to me. What's surprising is why am I in the minority here, and since when trusting authorities that have obvious conflicts of interest became normal.

reply
I don't think Firefox or The Linux Foundation have conflicts of interest here. They've said in their contracts that they get the tokens irrespective of what they say about Mythos. Additionally, the findings speak for themselves.

This just seems overly conspiratorial to me. I don't remember Anthropic ever lying in their blog posts. They've been about as consistent as Apple when it comes to product claims.

reply
Agreed, also amazing citations in the parent comment ^^
reply
> That may suit Anthropic as private models can't be distilled

They can be distilled internally… expect great things from Sonnet 4.8

reply
We already have "Opus" 4.7 from the same base
reply