By Aman Adukoorie
Anthropic’s recent release of Mythos has made waves in the industry. The cybersecurity-focused large language model that analyses codebases and uncovers exploitable flaws has demonstrated remarkable performance. The chief executive officer of a leading cybersecurity company recently revealed that in just six weeks, Mythos was able to uncover vulnerabilities that would have taken human engineers five to seven years to find.
For businesses, state-of-the-art models like Mythos provide a powerful tool for finding and patching security vulnerabilities. Unfortunately, the same capabilities can be used by malicious actors. According to IBM’s 2025 Cost of a Data Breach Report, in one of six security breaches, attackers are already leveraging AI. As LLMs become increasingly capable in terms of discovering and exploiting vulnerabilities, businesses will need to ensure that they are staying ahead of bad actors.
The models are getting better
Developers have added several key capabilities to cybersecurity-focused LLMs. State-of-the-art models now have much larger context windows, letting them ingest large complex codebases, architecture diagrams and system configurations simultaneously. This allows them to understand cross-file dependencies and find subtle vulnerabilities.
Models like Mythos can also ingest closed-source, stripped binary files and reconstruct plausible source code. The reconstructed source code can then be analysed to find exploitable vulnerabilities, which the model would not have been able to uncover by analysing closed-source binary files.
These improvements have enabled impressive results. Mythos, for example, autonomously identified thousands of previously unknown zero-day bugs, often decades old, in major operating systems and browsers.
Attack and defence
The industry has taken note. Anthropic, in collaboration with major technology leaders, launched Project Glasswing, a defensive coalition designed to protect critical software infrastructure. The initiative leveraged Mythos to detect vulnerabilities across operating systems, browsers and open-source codebases. Project Glasswing was able to identify thousands of high-severity flaws in critical software infrastructure that were then patched.
The capabilities of these models are changing industry practices. Going forward, engineering teams will embed cybersecurity-focused models into their development pipelines. These models will audit code modifications as they are proposed and scan for potential vulnerabilities. When vulnerabilities are identified, engineers will work with models to modify the proposed code and eliminate potential exploits, ensuring that they never reach production.
Malicious actors are not far behind. Underground communities have begun to develop ‘Dark LLMs’, large language models deliberately designed or modified to operate without ethical guardrails or safety filters. A recent study by researchers at Ben-Gurion University investigated the capabilities of these Dark LLMs. Worryingly, they found that the Dark LLMs they obtained were capable of finding vulnerabilities in critical software infrastructure.
In addition, they discovered that malicious actors are using LLMs to combine multiple, seemingly low-risk or unrelated flaws in sophisticated ways to create severe attacks, a technique known as vulnerability chaining.
In response, experts recommend that organisations bolster their defences. Organisations are advised to deploy agentic systems that periodically scan their codebases for potential vulnerabilities and patch them instantly. By shortening the exploit detection-patch lifecycle, organisations can substantially reduce the threat from vulnerability chaining, as patching a single vulnerability breaks the chain.
Experts are also beginning to recommend a novel technique known as ‘deception’. This involves purposely deploying deceptive assets to your codebase to mislead attackers. By emulating likely targets, for example FTP servers or web apps with known flaws, organisations can lure Dark LLMs into traps and thwart attacks. Furthermore, these traps can be used to identify the source of attacks, which can then be blocked, preventing future attacks.
A call for vigilance
LLMs represent a double-edged sword for cybersecurity. On one hand, they enable defensive efforts; models can analyse codebases and binaries, identifying subtle bugs and fixes. On the other hand, they make it easier for attackers to generate sophisticated attacks.
In this new landscape, businesses must simultaneously embrace and guard against LLMs. Through industry campaigns like Project Glasswing and by embedding cybersecurity-focused LLMs into their development lifecycle, organisations can secure their codebases. By leveraging techniques like deception and agentic exploit detection systems, they can thwart attackers.
The author is an experienced quantitative analyst. Views are personal.
