📝Cloudflare ran 📝Claude Mythos, a frontier security model from 📝Anthropic, against more than fifty of its own production repositories under an internal research program as a part of 📝Project Glasswing.
The verdict, as published on the Cloudflare blog: the model is a genuine step-change in AI-assisted vulnerability discovery — but only inside a purpose-built multi-agent harness, not a generic coding agent. Source:
What Made Mythos Preview Different
Two capabilities separated it from general-purpose frontier models like Opus 4.7 and GPT-5.5.
- Exploit-chain construction — it reasons through combining multiple weaknesses into a working exploit, the kind of analysis Cloudflare credits to a senior researcher. Earlier models found a bug and stopped; this one completes the chain on its own.
- Proof generation — it writes, compiles, and tests proof-of-concept code, iterating when tests fail rather than leaving exploitability as an untested hypothesis.
Safety Guardrails Were Inconsistent
The model carried partial safeguards but refused identical tasks depending on framing or surrounding context. Cloudflare's conclusion is blunt: organic refusals are not consistent enough to serve as a safety boundary, which is exactly why additional guardrails are needed before general availability.
The Signal-to-Noise Problem
Two forces inflate false positives in this work. Memory-unsafe languages like C and C++ generate far more false positives than memory-safe ones, and models over-report by nature — hedging with "possibly" and "potentially" and pushing the triage cost onto humans. Proof-of-concept generation is the lever that cuts the noise: an unproven finding gets discarded instead of escalated.
Why Generic Coding Agents Fail
Off-the-shelf coding agents are the wrong tool for vulnerability research. They chase a single hypothesis linearly where security work demands parallel investigation across many vulnerability classes, and they exhaust their context window after usefully covering only a fraction of a percent of a large codebase.
The Harness: An Eight-Stage Pipeline
Cloudflare's answer was architecture, not a smarter prompt — an eight-stage pipeline.
- Recon — generate architecture docs and an initial task queue.
- Hunt — roughly fifty concurrent agents, each assigned one specific attack class.
- Validate — an independent agent tries to disprove each finding.
- Gapfill — re-queue undertested areas.
- Dedupe — collapse variant findings into a single record.
- Trace — determine whether a bug is reachable from outside the system.
- Feedback — route results back into the queue to sharpen the next pass.
- Report — emit to a structured, queryable schema.
The load-bearing finding: narrow scope produces better findings. A named target function, a defined trust boundary, and real architecture context beat a generic "go find vulnerabilities" directive every time.
The Lesson for Defenders
Cloudflare pushes back on the emerging two-hour-patch-SLA reflex. Speed without regression testing just ships new bugs. What actually determines security posture is architectural resilience — isolation boundaries, defense-in-depth, and atomic rollback — not patch velocity. It also names the dual-use reality plainly: attackers will eventually hold equivalent tools. Security teams who want in can reach the program at [email protected].
Why It Matters Here
The harness is the story, not the model. Fifty narrowly-scoped parallel hunters, an adversarial validator that tries to disprove every claim, dedupe, and a reachability trace — that is the same orchestration pattern that governs any serious agentic infrastructure: fan out narrow, verify independently, collapse duplicates, prove the result. "Narrow scope produces better findings" is the security-research restatement of the systems principle that specificity beats generality in agent design — the model is a commodity input; the pipeline around it is the leverage. Worth a footnote: Anthropic shipped a security model named Mythos Preview while MythOS runs as a separate external-brain platform — no relation, just a clean collision of names.