Researchers show anthropic-style exploits can be reproduced with public AI, claims report.
Research shows that discovering vulnerabilities is already cheap and widely accessible.
Findings show that AI cyber capabilities may be spreading faster than expected.
When Anthropic unveiled Claude Mythos earlier this month, it ditched the model behind a vetted coalition of tech giants and labeled it as something too dangerous for the public. Treasury Secretary Scott Bessent and Fed Chairman Jerome Powell have called an emergency meeting with Wall Street CEOs. The word “vulnpocalypse‘ resurfaced in security circles.
And now a team of researchers has made that story even more complicated.
Vidoc Security took Anthropic’s own patched public samples and attempted to reproduce them using GPT-5.4 and Claude Opus 4.6 in an open-source coding agent called opencode. No Glasswing invite. No private API access. No anthropic internal stack.
“We replicated Mythos’ findings in open code using public models, not Anthropic’s private stack,” Dawid Moczadło, one of the researchers involved in the experiment, wrote on X after publishing the results. “A better way to read Anthropic’s Mythos issue is not ‘one lab has a magic model.’ The truth is: the economics of vulnerability discovery are changing.”
We replicated Mythos’ findings in open code using public models, not Anthropic’s private stack.
The moat shifts from model access to validation: finding vulnerability signals becomes cheaper; into trusted security
The cases they focused on were the same ones Anthropic highlighted in its public materials: a file-sharing protocol on a server, the networking stack of a security-focused operating system, the video processing software embedded in almost every media platform, and two cryptographic libraries used to verify digital identities on the Internet.
Both GPT-5.4 and Claude Opus 4.6 reproduced two bug cases in all three runs. Claude Opus 4.6 also independently rediscovered a bug in OpenBSD three times in a row, while GPT-5.4 scored zero. Some bugs (one related to the FFmpeg library to output videos and another related to digital signature processing with wolfSSL) were partially reverted, meaning the models found the correct code surface but could not identify the precise cause.
Image: Vidoc Security
Each scan was under $30 per file, meaning researchers were able to find the same vulnerabilities as Anthropic while spending less than $30.
“AI models are already good enough to shrink the search space, surface real leads, and sometimes find the full root cause in proven code,” Moczadło said on X.
The workflow they used was not a one-time prompt. It reflected what Anthropic itself publicly described: give the model a code base, let it explore, parallelize attempts, filter for signals. The Vidoc team built the same architecture with open tooling. A scheduling agent divided each file into chunks. A separate detection agent was run on each piece, which then inspected other files in the repository to confirm or rule out findings.
The line ranges within each detection prompt (e.g., “focus on lines 1158–1215”) were not manually chosen by the researchers. They were results of the previous planning step. The blog post makes this explicit: “We want to be explicit about that, because the chunking strategy determines what each detection agent sees, and we don’t want to present the workflow as more manually curated than it was.”
The study does not claim that public models match Mythos on everything. Anthropic’s model went beyond just catching the FreeBSD bug; it built a working attack blueprint, figuring out how an attacker could link code snippets together across multiple network packets to take full control of the machine remotely. Vidoc’s models discovered the error. They didn’t build the weapon. That’s where the real gap lies: not in finding the hole, but in knowing exactly how to walk through it.
But Moczadło’s argument is not really that public models are equally powerful. It’s that the expensive part of the workflow is now available to anyone with an API key: “The moat is shifting from model access to validation: finding vulnerability signals becomes cheaper; turning them into trusted security work is still difficult.”
Anthropic’s own security report acknowledged that Cybench, the metric used to measure whether a model poses a serious cyber risk, is “no longer sufficiently informative about the current capabilities of frontier models” because Mythos has fully endorsed it. The lab estimated that similar capabilities would spread from other AI labs within six to 18 months.
The Vidoc study suggests that the discovery side of that equation is already available outside of any gated program. Their full prompt excerpts, model results, and methodology appendix are published on the laboratory’s official site.
Daily debriefing Newsletter
Start every day with today’s top news stories, plus original articles, a podcast, videos and more.
