AI and Cybersecurity: Why Open Source Actually Gives Us a Fighting Chance

Following the Mythos and Project Glasswing announcements, there’s been a lot of hand-wringing about what this means for cybersecurity. I’ve been watching this space for a while, and I think most commentary is missing the point. It’s not about the model. It’s about the system.

What Mythos Actually Is (and Isn’t)

Mythos is a frontier LLM that’s good at code. That’s not new—code performance has been skyrocketing across models for a while. What’s different is the system wrapped around it: substantial compute, training on massive code datasets, scaffolding for vulnerability probing and patching, speed, and a degree of autonomy.

Together, those ingredients let it find exploits, exploit them, and patch them. The risks and benefits live in that recipe, not in any single model. And here’s the thing: smaller models in well-designed systems can probably do similar work for cheaper. That’s huge for defense.

AI cybersecurity capability is jagged. It doesn’t scale smoothly with model size or benchmark scores. The system matters a lot.

Why Open Source Is a Structural Advantage, Not a Liability

As autonomous vulnerability-hunting systems proliferate—and they will—the security game becomes a speed race across four stages: detection, verification, coordination, and patch propagation.

Open ecosystems distribute those stages across a community. Closed-source projects centralize everything inside a single vendor, creating a single point of failure. Only one organization can see and fix the code. That’s a terrible position to be in when attackers are getting better at reverse engineering stripped binaries.

A lot of legacy firmware and embedded code is closed, binary-only, and unmaintained. That’s a massive attack surface, and AI tools are making it increasingly legible. Proprietary obscurity doesn’t work like it used to.

There’s another risk I don’t see discussed enough: when companies adopt AI coding tools under bad incentives—like evaluating engineers by feature volume instead of code quality—AI-accelerated development can actually increase vulnerabilities. Those vulnerabilities sit in a closed codebase where only one organization can find and fix them, while AI-enabled attackers discover them from outside. That’s exactly the imbalance open ecosystems avoid.

Underlying all of this is capability asymmetry between attackers and defenders. Open models and tooling narrow that gap. Without them, defensive capabilities concentrate in a handful of well-resourced entities.

Semi-Autonomous Agents: The Sweet Spot

Based on the System Card, Mythos can operate with near-full autonomy. I’ve been skeptical of that approach—loss of control is a real risk. Semi-autonomous agents, where actions are prespecified and certain steps require human approval, hit a better balance.

With open code, organizations can run these agents privately, specifying allowed tools, skills, and access privileges. That’s how you deploy AI defensively: finding vulnerabilities and assisting with patching, but keeping humans in the loop.

The Bigger Picture

This isn’t just about cybersecurity. It’s about how we build AI systems that interact with the physical and digital world. Openness isn’t a nice-to-have; it’s a structural necessity for defense to keep pace with offense.

I expect we’ll see more systems like Mythos, both open and closed. The ones that matter for security will be the ones that are open enough to audit, adapt, and deploy across a community. Because when the attackers are using AI, the defenders need every advantage they can get.