Anthropic has given DefectDojo access to Claude Mythos.
We're grateful, and we intend to use it for good. I've had 48 hours with it.
The short version: it's good, largely as advertised. Here's what people don't understand, though.
Every time a model like Mythos shows up, the same story gets told. The machine finds zero-days in every operating system and every browser. Nobody can stop it. The sky is falling.
Here's the part the story leaves out. Mythos might be the most capable zero-day finder in cyber, and I say that having spent two days with it. But humans with similar capabilities exist. Some of you know that after I presented research at DEF CON, I had the privilege of testing certain systems at the Pentagon. The people who can do what Mythos does have been around for decades. Some of the wealthiest people I know in cyber got there by selling Mythos-grade vulnerabilities to governments.
The capability has been around for a long time. What changed is who can get it. Vetted defenders who could never have hired those people now have the same thing on tap, and for the first time the defense gets a shot at the talent the offense has always had.
Mythos is a key new capability in a security practitioner's arsenal, and it's going to become a necessity. I don't see it replacing traditional security tooling, whatever some AI-only vendors would like the world to believe, and I doubt it was ever meant to. Threat hunting, on the other hand, may be cooked. 💀
It's also the most intelligent model I've used, and like every frontier model, that depth takes time. Meanwhile, code has never shipped faster. Put those two together and you get the next few years: the deepest analysis anyone has ever had, pointed at codebases that grow every hour. The scanners, the SCA, the DAST, the connectors, the dedup and the triage all stay, because something has to keep up with the volume while Mythos goes deep on what matters.
I also wonder whether the classifiers that now sit in front of these models end up changing the scanning and detection market itself. Time will tell.
I don't think there has ever been a more exciting time to be in tech or in security. For most of my career the asymmetry ran one way. The best offensive talent was rare, expensive and mostly for sale to the highest bidder. Mythos-class capability in vetted defenders' hands flips that. Bugs get found and fixed before anyone gets to sell them or use them, and backlogs that sat for years finally get worked.
DefectDojo's job stays the same. Get every finding into one place. Figure out which ones matter. Fix them. Get the backlog to zero before an AI gets a chance to exploit it. We're honored to be at the frontier as these capabilities come to market, and grateful to Anthropic for trusting us with this one.
Fight AI with AI. Attackers have had this for years. Now we do.
Greg Anderson
CEO & Co-Founder, DefectDojo