# Epoch AI argues Mythos’s cyber capabilities are more than hype, but uneven [Canonical reading](https://escapemeridian.com/readings/epoch-ai-argues-mythos-s-cyber-capabilities-are-more-than-hype-4bdaf231) Epoch AI published this assessment on June 11, 2026. It argues that Claude Mythos Preview made a large advance in exploit development: building a way to use a known software weakness to cause unauthorized behavior. Epoch AI says its Cyber-ECI places Mythos Preview 7 months ahead of the trend since early 2025, and that Anthropic’s analyses found it better at developing exploits that enable arbitrary code execution. The case for a comparable leap in finding vulnerabilities is less clear. Epoch AI points to a sharp rise in serious vulnerabilities found by Project Glasswing participants, but says the initiative’s spending may explain some of that increase. It also reports that Mythos Preview found just one low-severity vulnerability in curl, alongside four false positives. Epoch AI says earlier AI was already good at finding vulnerabilities, while Mythos Preview’s lower false positive rate and better prioritization may reduce the human effort needed to assess them. Epoch AI says Mythos 5 is modestly better still, though real-world usage reports remain to be seen. It concludes that if the capabilities were widely available, vulnerabilities would need to be patched much faster to prevent a big increase in successful cyberattacks. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Epoch AI · Article Original source date: Jun 11, 2026 (2026-06-11T00:00:00.000Z). Date basis: Date supplied by the publisher’s feed. Added to Escape Meridian: 2026-11-06T16:28:23.566Z. First observed: 2026-10-18T03:19:25.463Z. Retrieved: 2026-10-24T05:23:36.821Z. - [Are Mythos’ cyber capabilities overhyped?](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Limits Text as retrieved on October 24, 2026; originally published June 11, 2026. The post says the practical advance in vulnerability discovery is unclear, and that Project Glasswing’s spending may have contributed to the reported increase in vulnerabilities found. Epoch AI says real-world usage reports are still needed to assess Mythos 5’s vulnerability-discovery capabilities. ## Open question How much of the increase in vulnerabilities found by Project Glasswing participants reflects Mythos Preview’s capabilities, rather than increased spending to search for weaknesses? ## Source-stated Epoch AI argues that Mythos Preview made a large advance in exploit development and was about 7 months ahead of the trend. > Mythos Preview was clearly a large improvement in exploit development — much better than GPT-5.5, and also 7 months ahead of past trends - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source-stated Epoch AI says evidence for a major improvement in vulnerability discovery is less clear, in part because increased spending may have contributed to the rise in findings. > It’s possible that earlier models could’ve found these vulnerabilities too, and the spike we see in the graph is due to a sharp rise in spending to find these code weaknesses. - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source-stated Epoch AI says Mythos Preview’s advantages in vulnerability discovery may be lower false positive rates and better prioritization, potentially reducing the human effort needed to assess findings. > This may be enough for a real practical impact, because you need much less human time and effort to assess AI-discovered vulnerabilities. - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source-stated Epoch AI concludes that if Mythos family capabilities were widely available, vulnerabilities would need to be patched much faster to prevent a big increase in successful cyberattacks. > If made widely available, these capabilities would likely move us into a new regime of cybersecurity, where vulnerabilities would need to be patched much faster to prevent a big increase in successful cyberattacks. - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source and contributor context Epoch AI · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media retrieval status: unchecked. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Epoch AI Epoch AI studies trends in AI capability, training resources and the infrastructure behind them. - [Explore this context](/entities/epoch-ai) - [Reference](https://epoch.ai/) - [Reference](https://epoch.ai/data) ## Claude Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding. - [Explore this context](/entities/claude) - [Reference](https://claude.com/product/overview) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Anthropic Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems. - [Explore this context](/entities/anthropic) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Editorial provenance Version 1. Publication ID: 9ab3b0c9-7080-f5c4-77ed-39315e94d207. Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-06T16:23:55.289Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: bridge\_admitted\_by\_model, second\_opinion\_categorical. Observation: 217c5dd209f40edc9ced0bfe80f33d7f427c3f9e36c3e1a9d44090be1e003c0b. Source text hash: 0de615464f681fb9089205c6e028f3b1502a575296d5714ea9533181d4996ca4. ## Revision and source-check history ### Version 1 — 2026-11-06T16:28:23.566Z Epoch AI published this assessment on June 11, 2026. It argues that Claude Mythos Preview made a large advance in exploit development: building a way to use a known software weakness to cause unauthorized behavior. Epoch AI says its Cyber-ECI places Mythos Preview 7 months ahead of the trend since early 2025, and that Anthropic’s analyses found it better at developing exploits that enable arbitrary code execution. The case for a comparable leap in finding vulnerabilities is less clear. Epoch AI points to a sharp rise in serious vulnerabilities found by Project Glasswing participants, but says the initiative’s spending may explain some of that increase. It also reports that Mythos Preview found just one low-severity vulnerability in curl, alongside four false positives. Epoch AI says earlier AI was already good at finding vulnerabilities, while Mythos Preview’s lower false positive rate and better prioritization may reduce the human effort needed to assess them. Epoch AI says Mythos 5 is modestly better still, though real-world usage reports remain to be seen. It concludes that if the capabilities were widely available, vulnerabilities would need to be patched much faster to prevent a big increase in successful cyberattacks. ## Original source Epoch AI · Article Original source date: Jun 11, 2026 (2026-06-11T00:00:00.000Z). Date basis: Date supplied by the publisher’s feed. Added to Escape Meridian: 2026-11-06T16:28:23.566Z. First observed: 2026-10-18T03:19:25.463Z. Retrieved: 2026-10-24T05:23:36.821Z. - [Are Mythos’ cyber capabilities overhyped?](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Limits Text as retrieved on October 24, 2026; originally published June 11, 2026. The post says the practical advance in vulnerability discovery is unclear, and that Project Glasswing’s spending may have contributed to the reported increase in vulnerabilities found. Epoch AI says real-world usage reports are still needed to assess Mythos 5’s vulnerability-discovery capabilities. ## Open question How much of the increase in vulnerabilities found by Project Glasswing participants reflects Mythos Preview’s capabilities, rather than increased spending to search for weaknesses? ## Source-stated Epoch AI argues that Mythos Preview made a large advance in exploit development and was about 7 months ahead of the trend. > Mythos Preview was clearly a large improvement in exploit development — much better than GPT-5.5, and also 7 months ahead of past trends - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source-stated Epoch AI says evidence for a major improvement in vulnerability discovery is less clear, in part because increased spending may have contributed to the rise in findings. > It’s possible that earlier models could’ve found these vulnerabilities too, and the spike we see in the graph is due to a sharp rise in spending to find these code weaknesses. - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source-stated Epoch AI says Mythos Preview’s advantages in vulnerability discovery may be lower false positive rates and better prioritization, potentially reducing the human effort needed to assess findings. > This may be enough for a real practical impact, because you need much less human time and effort to assess AI-discovered vulnerabilities. - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source-stated Epoch AI concludes that if Mythos family capabilities were widely available, vulnerabilities would need to be patched much faster to prevent a big increase in successful cyberattacks. > If made widely available, these capabilities would likely move us into a new regime of cybersecurity, where vulnerabilities would need to be patched much faster to prevent a big increase in successful cyberattacks. - [Supporting source](https://epoch.ai/gradient-updates/are-mythos-cyber-capabilities-overhyped) ## Source and contributor context Epoch AI · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media retrieval status: unchecked. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Epoch AI Epoch AI studies trends in AI capability, training resources and the infrastructure behind them. - [Explore this context](/entities/epoch-ai) - [Reference](https://epoch.ai/) - [Reference](https://epoch.ai/data) ## Claude Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding. - [Explore this context](/entities/claude) - [Reference](https://claude.com/product/overview) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Anthropic Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems. - [Explore this context](/entities/anthropic) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Editorial provenance Version 1. Publication ID: 9ab3b0c9-7080-f5c4-77ed-39315e94d207. Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-06T16:23:55.289Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: bridge\_admitted\_by\_model, second\_opinion\_categorical. Observation: 217c5dd209f40edc9ced0bfe80f33d7f427c3f9e36c3e1a9d44090be1e003c0b. Source text hash: 0de615464f681fb9089205c6e028f3b1502a575296d5714ea9533181d4996ca4. ### uncertain — 2026-11-06T16:23:55.289Z — anthropic/claude-opus-5.5 Publication: 9ab3b0c9-7080-f5c4-77ed-39315e94d207 attribution — pass: The reading consistently attributes its claims to Epoch AI, the publisher of this single analytical post. It separately attributes the exploit-development findings to Anthropic’s analyses and the curl finding to the curl maintainers' context. It does not present source assertions as established fact. > So our current take on the public evidence is this: Mythos Preview was clearly a large improvement in exploit development summary — uncertain: The overall shape is faithful: a strong exploit-development advance, an unclear vulnerability-discovery advance, and spending as a confounder. However, several central terms go unexplained and the definitions list is empty. Cyber-ECI, the key evidence, is never described as Epoch’s aggregate index built from about fifteen cyber benchmarks. Project Glasswing is not identified as Anthropic’s initiative giving partners access to Mythos Preview. Curl is not described as a heavily audited code library. Arbitrary code execution and false positives are also unexplained. Smallest repair: add brief plain-language glosses or tooltips for these terms. > We then aggregated them using a modification of our domain-specific Epoch Capabilities Index (ECI) methodology, giving us a Cyber-ECI. date — pass: June 11, 2026 matches the UTC calendar day of evidence.originalPublished, which is stated as an instant from a feed backfill. Forecasts are reported conditionally, there is no hindsight framing, and the kind is publisher-page, so no archive disclosure is needed. The source says Mythos 5 was released on Tuesday; the reading does not repeat this. support — uncertain: Most claims match their quoted text. However, the summary and claim 4 drop the source's hedge: the source says the capabilities would likely move us into a new regime. The reading instead says Epoch concludes vulnerabilities would need to be patched faster, which erases a stated uncertainty. Separately, the summary says Mythos 5 is modestly better still without the source's scope, which is exploit development. Smallest repair: restore the word likely and scope the Mythos 5 comparison. > If made widely available, these capabilities would likely move us into a new regime of cybersecurity media — pass: No media was selected and no verified media candidates were supplied, so there is no identity or relevance problem. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/4bdaf231f312f01a73a9420f46338e8f32a3e60f66bc05825a0bc542981cb39d/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/epoch-ai-argues-mythos-s-cyber-capabilities-are-more-than-hype-4bdaf231.json)