AI and the Future of Cybersecurity: Why Openness Matters

Following the announcement of Mythos and Project Glasswing, institutions throughout the world are grappling with the potential dawn of a new era of cybersecurity. In this post, we break down the current situation, discuss the role of openness, and situate the future of cybersecurity within the larger AI ecosystem.

What is Mythos?

Mythos is a “frontier AI model”, a large language model (LLM) that can be used to process software code (among many other things). This follows a general trend in LLM development, where LLM performance on code-related tasks has recently skyrocketed. What’s particularly significant about Mythos is the system it’s embedded within: It's the system, not the model alone, that has enabled Mythos to rapidly find and patch software vulnerabilities. Understanding this distinction is key to understanding the current landscape of AI cybersecurity.

What Mythos demonstrates is that the following system recipe is powerful:

• substantial compute power
• models trained on troves of software-relevant data
• scaffolding built to handle software vulnerability probing and patching
• speed (enabled by compute power and the capital behind it)
• some degree of system autonomy

Together, these ingredients can uncover software vulnerabilities, find exploits, and build patches. It’s in this recipe — not in any one model — that both the benefits and the risks come in.

This matters because others can build comparable systems. Smaller models embedded in systems built with deep security expertise could potentially produce similar outcomes more cheaply, which is particularly promising for defense. AI cybersecurity capability is jagged: It doesn’t scale smoothly with model size or general benchmark performance. The system the model is embedded within matters a lot.