AI and Cybersecurity: Why Open Source Might Save Us

Following the Mythos and Project Glasswing announcements, everyone in cybersecurity is trying to figure out what just hit them. I’ve been in this space long enough to know that hype cycles come and go, but this one feels different. Hugging Face’s Margaret Mitchell, Yacine Jernite, and Clem just published a breakdown that actually cuts through the noise, so let’s talk about it.

What Mythos Actually Is

Mythos is a frontier LLM trained to process code, but that’s not the interesting part. What matters is the system around it. The model alone isn’t doing anything revolutionary—it’s the combination of compute, training data, scaffolding for vulnerability probing, speed, and a degree of autonomy that makes it work. This is a recipe, not a single ingredient.

Here’s the kicker: you don’t need Mythos to replicate this. Smaller models, paired with serious security expertise, can produce similar outcomes for less money. AI cybersecurity capability is jagged—it doesn’t scale smoothly with model size. The system matters way more than the model.

Openness as a Structural Advantage

As autonomous vulnerability hunting systems proliferate (and they will), open code and tooling level the playing field. Security has become a four-stage speed race: detection, verification, coordination, patch propagation. Open ecosystems distribute these stages across a community. Closed-source projects centralize everything inside a single vendor, creating a single point of failure where only one organization can see and fix the code.

I’ve seen this play out before. The Linux kernel security team and the Open Source Security Foundation are proof that distributed development is robust. Meanwhile, proprietary obscurity—hiding code behind closed doors—is losing its power. AI tools are getting better at reverse engineering stripped binaries, and most legacy firmware is closed, binary-only, and unmaintained. That’s a massive attack surface that’s becoming increasingly legible to AI.

There’s another risk that doesn’t get enough attention: AI coding tools inside closed codebases. When companies evaluate engineers on feature volume instead of code quality, AI-accelerated development pumps out more vulnerabilities faster. Those vulnerabilities sit behind a single-organization firewall, while AI-enabled attackers are getting better at finding them from the outside. That imbalance is exactly what open ecosystems avoid.

Semi-Autonomous Agents for Defense

The Mythos system card suggests it can operate with near-full autonomy. I’ve been skeptical of that approach—loss of control is a real concern. Semi-autonomous agents hit the sweet spot: prespecified actions, human approval for critical steps, and open code that organizations can run privately. This lets defenders find vulnerabilities and assist with patching without handing over the keys.

Open models narrow the capability asymmetry between attackers and defenders. Without openness, those capabilities concentrate in a handful of well-resourced entities. That’s not a future I want to live in.