The $0.11 model found the same bugs as the one too dangerous to release

Mythos found thousands of zero-days behind a restricted API. Cheap, local models find most of the same bugs. Why that's the whole bet behind Codelight.

Anthropic shipped a model "too dangerous to release." The research that followed showed small, cheap, local models find most of the same bugs. We didn't want to take that on faith — so we rebuilt it ourselves, then pushed it past where the original research stopped: into actually exploiting the bugs.

When Anthropic unveiled Claude Mythos Preview alongside Project Glasswing on April 7, 2026, the framing was unambiguous: a model so good at finding zero-day vulnerabilities that it would not be released publicly. Access was gated to a vetted consortium, priced at $25/$125 per million input/output tokens — five times Opus 4.6 — and backed by up to $100M in usage credits. Mythos, Anthropic said, had autonomously discovered thousands of zero-days, including a 17-year-old RCE in FreeBSD and a 27-year-old TCP SACK bug in OpenBSD.

A genuine milestone. But within a day, Stanislav Fort at AISLE was asking the question that actually matters for everyone who isn't in the consortium: how much of this needs a frontier model at all? His two post-Mythos write-ups — "AI Cybersecurity After Mythos" and "System Over Model" — ran Mythos's showcase bugs through 25+ models and pointed a deliberately dumb scanner at whole production kernels.

His short answer: detection is commoditized, capability is jagged, and the moat is the system — not the model. We think that's correct. But Fort's work deliberately stopped at detection and analysis. The part everyone treats as frontier-only — turning a bug into a working exploit — was left untested. That's the part we built.

The findings we build on

Two results from the post-Mythos research set up everything we did.

Detection is commoditized. Run Mythos's showcase bugs through 25+ models and the headline find — FreeBSD's CVE-2026-4747 NFS stack overflow — is caught by eight of eight tested models (a representative five below), including a 3.6B-active model at $0.11 per million tokens that correctly computed the remaining buffer space and flagged it wormable.

Our reading: detection capability for memory-safety classes is already a solved, cheap problem. If that's the bar, you do not need a restricted frontier API — you need a model small enough to run on your own hardware. We've shipped exactly that.

Capability is jagged. There is no stable "best model." On an OWASP false-positive trap — a Java servlet that looks like SQL injection but discards the input before the query — small open models beat most frontier models, while models that ace C buffer-overflow math confidently call the OpenBSD SACK code "robust."

Our reading: this isn't a problem to engineer away — it's a design spec. Because no single model wins everywhere, we don't ship one. Codelight runs small models fine-tuned per language and provisions the right specialist per request: a C kernel file gets a memory-safety model; a Java servlet gets one tuned for injection and data-flow. A fleet of sharp small models beats one big generalist on the work that matters.

That's the floor. Now the part nobody else tested.

Where the research stopped

The overlap between small models and Mythos is strongest in detection and analysis. It was assumed to collapse at exploit construction — the weaponization Anthropic showcased: chaining browser bugs into sandbox escapes, multi-gadget ROP chains, KASLR bypasses, at $1,000–$2,000 per exploit. When researchers posed Mythos's real constraint to small models (payload needs 1,000+ bytes, the overflow gives ~304), none reproduced Mythos's actual trick — splitting the write across 15 RPC requests of 32 bytes each.

But — and this is the gap we cared about — that work was explicitly scoped to detection. It did not use agentic tooling. No compile-run-observe loop, no iteration against a real target. The models were asked to reason about exploitation in one shot, on paper. The honest open question was never answered: give a local model a real harness — tools, a loop, a crash oracle — and can it cross from reasoning about an exploit to producing one that runs?

So we answered it.

What we built, and what it did

We started by not trusting the table. We stood up our own validation and evaluation harness and reproduced the detection results on hardware we control — same conclusion, our own infrastructure. That's table stakes; the interesting work starts after the bug is found.

Then we extended the harness through the stages the Mythos narrative treats as frontier-exclusive: skeptical triage, exploit synthesis, and — the piece that actually separates "plausible" from "working" — validation against a live target. A loop that can compile, run, watch what happens, and revise. The crash oracle is the whole game: it's the difference between a model that argues an exploit should work and a system that confirms one does.

We pointed it at OpenSSH — not a toy, not a CTF binary — and gave it four previously disclosed vulnerabilities. The task wasn't "find the bug." It was "produce a proof of exploit that runs."

A Codelight model, running locally in an agentic loop with tool access, produced working PoCs for three of the four.

What that took — and didn't:

• It didn't take a frontier model. It took one of our local specialists — the same class of small model that's enough for detection.
• It didn't leave the building. Every stage — analysis, synthesis, every compile-and-run iteration — happened inside our own perimeter. No source, no intermediate exploit artifact, ever went to a third-party API.
• It did take a real system. Given a single shot, the model lands where the on-paper experiments did: good reasoning, no working exploit. The loop — synthesize, run, read the crash, adjust — is what carried three of the four across the line.

The fourth is as instructive as the three. It needed the genuine frontier skill: the creative-engineering leap of "treat this bug as a reusable primitive and assemble the payload across rounds." Our harness reasoned around the constraint but didn't converge on a working chain within the run budget we gave it. That's a real boundary, and we're not going to paper over it: the very top of exploit construction still rewards stronger reasoning. But "3 of 4 working PoCs from a small local model" is a long way from "this capability requires a model too dangerous to release."

(Scope, stated plainly: a small internal set of already-disclosed bugs, run through a harness we built and validated by hand. Not a benchmark. Enough to convince us the line sits much closer than the Mythos framing implied.)

Why this is the whole bet

Put the pieces together and you get Codelight's actual thesis, which the evidence supports at every step:

1. Detection is commoditized → you don't need a frontier model to find the bug.
2. Capability is jagged → you shouldn't ship one model; you should route per language, per request.
3. The moat is the system → value lives in the harness — targeting, triage, the crash oracle, the validation loop — not the weights.
4. And the system can run locally → our OpenSSH result says the loop that crosses into exploitation fits inside your perimeter too.

The thing that separated a "useful" security model from a "dangerous" one was never the weights. It was the system wrapped around them. We build that system, and we run it on your hardware.

There's an honest counterweight, and we'll say it out loud because it's the part we actually compete on: specificity is hard for small models. In published testing, a 3.6B model found the FreeBSD bug 3/3 times on vulnerable code but false-positived 3/3 on the patched version. A scanner that cries wolf is the thing that killed curl's bug-bounty program. Getting "real and reachable" right — not just "looks like a bug" — is exactly where the system around the model earns its keep.

Why it runs on your hardware

Every cloud result above shares one cost: the source under analysis is shipped to a third party. For most teams scanning their own production code, that single fact is the biggest blocker to adopting AI security tooling at all. Proprietary source, regulated workloads, defense and critical-infrastructure codebases that legally cannot touch an external endpoint — "send the whole repo to a cloud model" is a non-starter, however capable that model is.

Published testing already showed adequate detection fits in a 3.6B–5.1B active-parameter model. Our OpenSSH work suggests the exploitation loop fits there too. So we run exactly that class of model locally and air-gapped: scanning, triage, and exploit-validation all happen inside your perimeter. The code stays put; only the findings leave, if you choose to send them anywhere at all. (More on that principle: your code never leaves Europe.)

And because it's your hardware, the meter is off. The cost models that force a frontier scanner to ration runs against a handful of ranked files — Anthropic's red team reports ~$10k to find a 16-year-old FFmpeg bug and under $20k for the OpenBSD SACK chain, at $25 per million tokens — simply don't apply. (AISLE, by contrast, swept two entire kernels for under $100 on hosted small models — and run that same class of model locally and the per-token cost falls away entirely.) A local model can sweep every file, every commit, as many times as you want, for the price of the electricity. Tireless and unmetered: that's the combination that actually lets you point enough eyes at the code.

What this means for defenders

• You don't need a Glasswing invitation. Discovery-grade capability is broadly accessible today, at ~600–800× lower cost than Mythos, with models you can run locally.
• Build the system, not a model dependency. Targeting, triage, validation, remediation — that's the durable value. The model is a replaceable component.
• Route by task, not by price. A single-model pipeline has blind spots, because rankings reshuffle across tasks.
• Don't assume exploitation is out of reach. It's the genuine frontier skill — but our OpenSSH results put the boundary closer than the public framing implied, and inside a local harness.
• Keep the code on-prem. For proprietary, regulated, or air-gapped code, a local scanner isn't a compromise — it's the only deployable option.

The bottom line

Mythos validated the category and put real money behind open-source security. But the capability it locked behind a restricted API isn't as exclusive as the framing suggested. A $0.11 model found the headline FreeBSD bug. A 5.1B open model recovered a 27-year-old OpenBSD chain. And in our own harness, a small local model wrote working proof-of-exploit code for three of four OpenSSH vulnerabilities — without a single byte of source leaving the building.

And there's a deeper reason this only goes one way. A reviewer gets tired, skips the boring file, loses the thread three functions deep. A model doesn't. It never gets bored of the 4,000th file, never assumes the auth check is fine because it usually is, never runs out of patience on attempt forty. Point enough adequate eyes at a codebase and give them enough tokens, and they will find more than any human team — not because they're smarter, but because they don't stop. The economics of attention that limit human review simply don't apply.

The future of AI security tooling isn't only about how smart the model is. It's about where it runs, how good the system around it is, and how many tokens you're willing to spend looking. That's what we build at Codelight.

See how Codelight works →

The detection experiments, the FreeBSD/OpenBSD/OWASP tables, and the "jagged frontier" framing come from Stanislav Fort's post-Mythos research at AISLE. We're grateful for it — it's what we built our own harness on top of. The OpenSSH exploitation work, and every opinion above, is ours.

Sources

• Stanislav Fort / AISLE, "AI Cybersecurity After Mythos: The Jagged Frontier" (Apr 7–9, 2026) — detection overlap experiments, OWASP/FreeBSD/OpenBSD tables.
• Stanislav Fort / AISLE, "System Over Model: Zero-Day Discovery at the Jagged Frontier" (Apr 14, 2026) — whole-kernel scan, the under-$100 two-kernel sweep, the ~100× pricing comparison ($0.20/M vs $25/M), confirmed FreeBSD bugs.
• Anthropic Red Team, "Assessing Claude Mythos Preview's cybersecurity capabilities" — Mythos harness; cost figures: $25/$125 per M tokens, ~$10k (FFmpeg), under $20k (OpenBSD SACK), $1k–$2k per Linux-kernel exploit.
• Anthropic, "Project Glasswing" — consortium, funding commitments.
• SentinelOne, CVE-2026-4747 entry — FreeBSD RPCSEC_GSS RCE details.

Topics: #security #ai #data-sovereignty