You're Being Misled About Mythos
Anthropic has given DefectDojo access to Claude Mythos.
We're grateful, and we intend to use it for good. I've had a week with it.
The short version: it's good, largely as advertised. Here's what people don't understand, though.
What people get wrong
The story being told about Mythos goes like this. The machine finds zero-days in every operating system and every browser. Nobody can stop it. The sky is falling.
Here's the part the story leaves out. Mythos may be the most capable vulnerability discovery engine ever built, and I say that having spent a week with it. But humans with similar capabilities exist. Some of you know that after I presented research at DEF CON, I had the privilege of testing certain systems at the Pentagon. The people who can do what Mythos does have been around for decades. Some of the wealthiest people I know in cyber got there by selling Mythos-grade vulnerabilities to governments.
What's changing is that the capability is going to be in the hands of those beyond governments and nation-state actors. For the first time the defense gets a shot at the talent the offense has always had.
What a week taught me
Mythos is a key new capability in a security practitioner's arsenal, and it's going to become a necessity. I don't see it replacing traditional security tooling, despite what some AI-only vendors would like the world to believe, and I doubt it was ever meant to. Human threat hunting, on the other hand, may be doomed. 💀
It's also the most intelligent model I've used, and like every frontier model, that depth takes time. Meanwhile, code has never shipped faster. Put those two together and you get the next few years: the deepest analysis anyone has ever had, pointed at codebases that grow every hour. The scanners, the SCA, the DAST, the connectors, the dedup and the triage all stay, because something has to keep up with the volume while Mythos goes deep on what matters.
I also wonder whether the classifiers that now sit in front of these models end up changing the scanning and detection market itself. Time will tell.
Why I'm excited
I don't think there has ever been a more exciting time to be in tech or in security. For most of my career the asymmetry ran one way. The best offensive talent was rare, expensive and mostly for sale to the highest bidder. Mythos-class capability in vetted defenders' hands flips that. Bugs get found and fixed before anyone gets to sell them or use them, and backlogs that sat for years finally get worked.
DefectDojo's job stays the same. Get every finding into one place. Figure out which ones matter. Fix them. Get the backlog to zero before an AI gets a chance to exploit it. We're honored to be at the frontier as these capabilities come to market, and grateful to Anthropic for trusting us with this one.
Fight AI with AI.
Greg Anderson
CEO & Co-Founder, DefectDojo