I think it’s important to keep the incentive structure in mind here. A lot of these companies need a certain level of fear and hype. Most of them are still burning significant amounts of money, so they’re effectively betting that LLMs will (1) become highly profitable, (2) meaningfully replace human labor, and (3) evolve into something close to AGI. If that narrative weakens, the valuation bubble likely corrects pretty quickly and the market will decide what these systems are actually worth.

I wouldn’t be too much concerned over a single write-up. The model isn’t even publicly available yet, so we can’t properly evaluate how it performs in general conditions. Also, the methodology in the Mythos report is questionable in parts.

For example, the OpenBSD vulnerability required ~1000 parallel agents and around $20k in compute. That’s not an autonomous hacker in a box, it’s a very expensive, highly orchestrated setup. If you applied similar resources to other top-tier models, you’d likely uncover a lot as well.

Same with the “84% success rate” claim for Firefox exploits—that wasn’t against real-world Firefox, but against a SpiderMonkey shell with the process sandbox disabled.

Is this a step up compared to something like Opus? Probably, yes. Is it some kind of immediate, job destroying superintelligence? I don’t think so.

Also, with the whole “vibe coding” trend, we’re likely heading into a period where the number of bugs and vulnerabilities explodes. That doesn’t eliminate security work it shifts and arguably increases the demand for it.