← Back to Library

Mythos and national power

Jordan Schneider's latest analysis for ChinaTalk doesn't just report on a new AI model; it identifies a potential paradigm shift in the very nature of digital warfare. The piece centers on Anthropic's "Mythos," a system that has reportedly unearthed decades-old vulnerabilities in foundational code that millions of automated tests and human experts missed. This isn't merely a technical update; it suggests the end of the assumption that "enough eyeballs" make software secure, forcing a re-evaluation of how nations defend their critical infrastructure and how conflicts are fought in the shadows.

The End of the "Many Eyeballs" Myth

Schneider frames the discovery not as a routine patch, but as a fundamental challenge to open-source dogma. He brings in Ben Buchanan, a former senior advisor for AI at the White House, to contextualize the scale of the breakthrough. Buchanan notes that while the idea of automated vulnerability discovery was imagined a decade ago, "it does feel like something that had long been imagined is actually now finally here." The evidence provided is stark: Mythos found bugs in code that has been running the world's operating systems and browsers for decades, code that was previously thought to be axiomatic in its security.

Mythos and national power

Schneider highlights the shock this caused even among the original developers. "Knowing that at some point this day would probably come where they'd find problems in it, but that today was going to be the day, and it would be a machine that did it," says Michael Sulmeyer, former Assistant Secretary of Defense for Cyber Policy. This moment shatters the long-held belief that human scrutiny alone is sufficient. As Buchanan argues, "we need to have machines look too — or at least, a machine of this capability level can find things that a lot of good humans looking for a long time didn't find."

The core credo of the open-source software movement... is: with enough eyeballs, all bugs are shallow. Basically, if enough smart people are looking, they will find everything that is to be found. I think the answer for this moment is we need to have machines look too.

This reframing is crucial. It moves the conversation from "we missed a bug" to "our entire methodology for ensuring security is now obsolete." The implication is that the defensive advantage, which has long relied on the difficulty of finding flaws, is evaporating. Critics might argue that export controls on the massive compute power required to train such models will slow proliferation, but as Schneider notes, the genie is already out of the bottle regarding the concept of autonomous vulnerability discovery.

The Offense-Defense Balance and the "Kill Chain"

The commentary then pivots to the geopolitical implications, specifically how this technology alters the "kill chain"—the sequence of steps an attacker takes to compromise a system. Schneider draws on a 2016 talk by Rob Joyce, former head of the NSA's Tailored Access Operations, to show that AI was theoretically capable of aiding every step of an offensive operation years ago. Now, with Mythos, that theory has become practice. The system reportedly completed a simulated network exploitation in minutes that would have taken a human operator ten hours.

Schneider uses the Russia-Ukraine conflict as a stress test for this new reality. While cyber operations have played a role, they haven't been the deciding factor in battlefield morale or progress. However, the introduction of a tool like Mythos could change that calculus. Sulmeyer suggests that if one nation possessed this capability exclusively, it would create a massive asymmetry: "if you've got the offense, you're the only one, and defense doesn't know, it's pretty open season."

The author wisely distinguishes between the "whiz-bang" destructive attacks often dramatized in media and the more insidious reality of cyber operations: "shaping." Buchanan argues that the true power of such a tool lies not in blowing up power grids, but in "the slow, insidious shaping of the environment and collection of information." This aligns with the historical precedent of the Vulnerabilities Equities Process, where the government debates whether to disclose a flaw to the public or hoard it for intelligence gathering. The stakes here are higher because the discovery process itself is now automated and infinitely scalable.

The broadest thing you could say about a capability like this is, in the abstract, it has some brandishing value or maybe even deterrent value because it bolsters the status of the nation that has it. But I imagine a government who truly wanted to play offense would want this kept quiet so that people don't go looking for it.

Project Glasswing and the Proliferation Clock

Schneider addresses the inevitable question of control: who gets this tool, and for how long? He details Anthropic's "Project Glasswing," an initiative to provide access to major tech firms like Apple and Google to patch vulnerabilities before the technology proliferates. This is effectively a private-sector attempt to replicate the government's Vulnerabilities Equities Process, but with a race against time. "We don't know how much time we have," Sulmeyer admits. "It's probably not a ton, even though I think it's more than some people expect."

The piece acknowledges the fragility of this arrangement. The technology will eventually leak, be replicated, or be stolen. The transition period is the only window for defense. Schneider notes that while Anthropic claims the goal is to "tilt the balance of power in cyber operations to the defender," the reality is that the same capability can be turned to offense with minimal friction. The comparison to the "Atomic Bomb of Cybersecurity" is not hyperbole; it is a structural shift in the offense-defense balance where the attacker gains a speed advantage that defenders may never fully close.

The bottom line for me is this is incredibly important for understanding the landscape of modern cyber operations, but it does not fundamentally change their character, which I think is still one of shaping rather than signaling.

Bottom Line

Schneider's analysis succeeds in stripping away the hype to reveal a sobering structural change: the era of relying on human diligence to secure foundational code is over. The strongest part of the argument is the evidence that machines can now find flaws in decades-old code that human experts missed, rendering the "many eyeballs" theory obsolete. However, the piece's biggest vulnerability lies in its reliance on the goodwill of private actors and the temporary nature of export controls to manage a capability that is inherently dual-use and easily replicable. The reader should watch for how the executive branch navigates the tension between hoarding these vulnerabilities for intelligence and the desperate need to patch the global digital infrastructure before the window closes. The human cost of a failure here is not just data loss, but the potential destabilization of the critical systems that keep societies functioning.

Deep Dives

Explore these related deep dives:

  • Dark Territory: The Secret History of Cyber War Amazon · Better World Books by Fred Kaplan

  • Vulnerabilities Equities Process

    The article highlights Project Glasswing's attempt to create a private-sector version of this government framework, explaining the critical debate over whether to disclose or hoard zero-day exploits.

  • Heartbleed

    This 2014 discovery of a 2-year-old bug in the OpenSSL library serves as the historical benchmark for the kind of decades-old, widely deployed vulnerabilities that Mythos is now finding in foundational code.

  • Stuxnet

    The article's discussion of how AI-driven exploits could alter the offense-defense balance in Ukraine and Russia draws a direct parallel to this specific cyberweapon that proved code could physically destroy infrastructure.

Sources

Mythos and national power

by Jordan Schneider · ChinaTalk · Read full article

Anthropic’s new model found decades-old vulnerabilities in foundational open-source code that millions of automated tests and countless human experts had missed, presaging a potentially revolutionary moment in cyber.

Ben Buchanan, former senior advisor for AI at the White House now at SAIS, and Michael Sulmeyer, former Assistant Secretary of Defense for Cyber Policy now at Georgetown, join the show to break it all down.

Full disclosure: Ben advises Anthropic.

We discuss…

How Mythos found 27-year-old bugs in code everyone thought was secure

The offense-defense balance: whether a Ukraine with Mythos and a Russia without it changes the war

Project Glasswing and Anthropic’s attempt to build a private-sector vulnerabilities equities process

Why critical infrastructure patching is about to become a nightmare

What happens when ransomware gets vibe-coded

Why bio won’t be far behind

Listen now on your favorite podcast app.

Has the Atomic Bomb of Cybersecurity Just Been Discovered?.

Jordan Schneider: So how big a deal is Claude Mythos?

Ben Buchanan: This is a big one. I’ve been thinking about cybersecurity and AI for more than a decade. I think a lot of us who were thinking about AI and cyber back then imagined that a day like this might come where you could see automated vulnerability discovery. It does feel like something that had long been imagined is actually now finally here, and it’s up to all of us to figure out what that means.

Jordan Schneider: So what can the model do?

Ben Buchanan: What this system does at its core is it takes a general-purpose capability — it is not a cyber-specific model — and applies it to the business of vulnerability discovery and exploit development. As Michael can attest very well, these are fundamental tasks in cybersecurity: finding a weakness in a piece of computer code and then figuring out how to exploit that weakness to do something as an attacker that you’re not allowed to do.

The evidence is very clear that Claude Mythos is by far the best automated system in the world ever to do this, and is better than even some of the best expert humans — or close to some of the absolute top-tier expert humans — at this task of vulnerability discovery and exploit development. The proof is in the pudding. It found vulnerabilities in code that all of our operating systems and all of our browsers are running. Those vulnerabilities ...