Unpacking the 'Son of Mythos': AI's Role in Vulnerability Discovery

Key points

• Anthropic's Project Glasswing is adding roughly 150 vetted partners after an initial cohort of around 50 organizations joined in April.
• OpenAI has reportedly offered nine major UK banks access to its GPT-5.5 Cyber tool.
• AI can chain medium-severity flaws into high-impact exploits, a capability that makes conventional CVSS scoring less useful.
• The UK's NCSC estimates China is about eight months behind the frontier, narrowing the gap faster than most defenders expected.
• Experts say the organizations that gain most will be those that can validate and fix findings before attackers get there first.

What is Project Glasswing?

Project Glasswing is Anthropic's scheme to give selected organizations access to Claude Mythos, an AI-powered vulnerability discovery tool. We covered the expansion directly in our 3 June report, which flagged a patching bottleneck even as the partner list grew. What that story couldn't capture was the conference context: at Infosecurity Europe, Gunter Ollmann, CTO at penetration testing firm Cobalt, pointed out that frontier models from Google and two Chinese developers aren't far behind. "These frontier AI tools are still restricted in their access, but they're only going to get cheaper as we go along," he said.

Should you worry about misuse?

Yes, and so does the NCSC. Paul Chichester, the centre's director of operations, told Infosecurity Europe delegates that misuse is a real threat while also pushing costs onto adversaries. His practical advice was concrete: write better code, run vulnerability scans, harden access controls, and exercise your incident response plan. Chichester also noted AI's potential to make penetration testing available to organizations that currently can't afford it.

Daniel Wilcock, threat intelligence analyst at managed security services firm Talion, was blunter. Organizations that ignore advanced AI risk falling behind attackers who are already using it. That's not a projection; it's the current state.

Why does 'vulnerability chaining' change the picture?

Ollmann told CSO Online that Mythos appears to work with a level of code access and analysis flexibility that most commercial testing platforms don't have, including the ability to examine behaviours that licensing terms often restrict. The practical result: it becomes much easier to string several medium-severity flaws together into something with a high overall impact.

The same theme ran through a Mythos panel at the CSO Cybersecurity Awards in the US. Jim Reavis, CEO and co-founder of the Cloud Security Alliance, said AI-driven chaining disrupts the mental model defenders use in threat modeling. "CVSS scoring, it seems like that's not super relevant anymore," he told attendees. Jon Yeoh, chief scientific officer at the CSA, framed it plainly: "This is a major step change in what AI can do."

The watch-next item here is whether CVSS maintainers move to address chaining explicitly, or whether the industry sidesteps the standard altogether. Either way, a score on an individual flaw tells you less than it used to.