Two frontier AI labs used the same week in early September to make an uncomfortable claim: their models can now find and weaponize software vulnerabilities about as well as, or in measured cases better than, the human researchers who have done that work for decades. OpenAI’s newly released GPT-6 Astra scored a perfect 100% on ExploitBench, the company’s internal test of turning a known flaw into a working exploit. Anthropic’s unreleased Claude Mythos Preview built a full working exploit out of a Firefox JavaScript-engine bug 181 times in the same test where its predecessor, Opus 4.6, managed it only twice in several hundred attempts. Neither claim is theoretical. Both labs backed it with numbers, and both are now selling access to the defensive side of the same capability. For a security leader, the headline is not the benchmark score. It is what the benchmark implies about who finds the next Chrome or Cisco flaw first, and how much runway defenders will have once it is found.
The same week, two labs, the same argument
OpenAI said GPT-6 Astra is the first of its models to cross the “Critical” cybersecurity capability threshold under its Preparedness Framework, meaning that with the right tools and access it can find previously unknown security flaws and develop new ways to exploit them across well-protected systems without a person guiding each step. On ExploitBench, which measures whether a model can turn a known vulnerability into a working exploit, Astra reached 100%, up from 78.5% for GPT-5.6 Sol, its prior frontier cyber-capable model. On the harder ExploitGym benchmark, which covers a broader range of exploit development, Astra reached 42.4% against Sol’s 30.3%, using fewer output tokens to get there. OpenAI also tested Astra against vulnerabilities disclosed in the three months before launch, to check whether it could find genuinely new flaws rather than recall known exploits from its training data. It found two.
Anthropic’s disclosure, published as an assessment of Claude Mythos Preview’s cybersecurity capabilities, is built around a different kind of evidence: scale. The company pointed the model at 281 open-source projects and collected 23,019 candidate vulnerabilities. External security firms manually reviewed 1,900 of them; 1,596 were reported to the affected maintainers, who acknowledged 1,451; 97 fixes had landed upstream and 88 findings had become published security advisories as of May 22, 2026. On a memory-safety benchmark, Sonnet 4.6 and Opus 4.6 reached the first severity tier in 150 to 175 cases each but only a single crash at the third of five tiers. Mythos Preview reached 595 crashes at the first two tiers and achieved full control-flow hijacks, the most severe tier, on ten separate, fully patched targets. In one case, Anthropic said it turned a known Linux kernel use-after-free bug into a working root exploit for less than $2,000 in inference cost and under a day of runtime.
Media Partner
What is actually new here: triage, not discovery
The mechanism behind both claims is the same, and it is not really “AI writes exploits” in the cinematic sense. It is that a language model can now iterate through candidate exploitation paths for a known bug class, at low cost and high volume, faster than a human researcher manually reasoning through the same code. Anthropic’s own numbers show where the real bottleneck moved: the model produced 23,019 candidates, but only 1,900 were reviewed by outside experts, and only 1,451 were confirmed to matter. Discovery scaled by roughly an order of magnitude. Human triage capacity did not. Anthropic reported that its expert contractors agreed exactly with the model’s own severity assessment in 89% of a manually reviewed sample, and were within one severity level 98% of the time, which is the company’s argument that the triage bottleneck can itself be partly automated. Whether that holds up once the process runs against production infrastructure rather than curated open-source projects is the open question CISOs should track over the next two quarters, not assume answered.
The comparison to CyberTech’s reporting on the METR incident is direct: that case showed an AI agent extending its own access without a human writing new exploit code step by step. Astra and Mythos describe the same shift applied specifically to the vulnerability-research pipeline that has historically supplied both bug bounty programs and, less happily, exploit brokers.
Neither lab is shipping this to the general public
Both companies built the release around restricting the offensive half of the capability. OpenAI said the public version of Astra will refuse to generate proof-of-concept exploits or other advanced offensive material, with stricter isolation, checkpoint encryption, and monitoring of full model reasoning traces built in specifically to catch attempts to misuse the cyber capability. Anthropic said more than 99% of the vulnerabilities Mythos Preview found have not yet been patched, “so it would be irresponsible for us to disclose details about them,” and committed to a coordinated disclosure timeline of no later than 90 plus 45 days after it reports a vulnerability to the affected party. Anthropic also said it plans new safeguards alongside an upcoming Claude Opus model and a forthcoming “Cyber Verification Program” for vetted security professionals.
The other half of the bet: subsidizing the defenders
Both labs paired the offensive disclosure with a defensive access program, which is the part a security leader can actually act on this quarter. OpenAI is putting $1 billion in subsidized access behind a program it calls Daybreak, aimed at “frontline defenders” who lack enterprise security budgets. It is prioritizing operators of essential services, including water and wastewater systems and electric grid operators, alongside state and local governments, community and regional banks, nonprofits, and open-source maintainers, with the funding meant to be consumed over the next six months. The program runs two tiers: broader access to GPT-5.6 Cyber for advanced work like finding zero-days and building exploit chains, and access to GPT-5.6 Sol for secure code review, malware analysis, incident response, patch validation, and vulnerability discovery. OpenAI said thousands of defenders across roughly 2,000 approved organizations, including cybersecurity vendors, defense organizations, and law enforcement agencies, already use the program. Anthropic’s answer runs through the same bug bounty infrastructure it used to validate Mythos: on May 7, 2026, exactly one month after the Mythos announcement, it took its previously closed HackerOne program and opened it to the public, covering Claude.ai, the Anthropic API, Claude Code, its desktop and mobile clients, internal infrastructure, SDKs, and its Chrome extensions and MCP integrations.
What it means for the security leader
The practical shift is not that attackers suddenly have a magic exploit button. It is that the economics of finding a flaw in something you run, whether that is an open-source library, a browser, or enterprise infrastructure, just moved. A defender who treats AI-assisted discovery as strictly a vendor problem is missing the second half of the announcement: the same model classes are now being subsidized specifically so defenders can run the same kind of automated review against their own code and infrastructure before someone else does. Security teams at eligible organizations, particularly critical-infrastructure operators, community banks, and open-source maintainers, have a concrete reason to evaluate the Daybreak tiers or a comparable AI-assisted review pipeline this year rather than treating the announcement as a headline to skim.
The second, less comfortable implication is about patch cadence. Cisco’s advisory for CVE-2026-20212, a critical unauthenticated remote-code-execution flaw in Nexus 9000 switches running Silicon One ASICs disclosed the same week, was found the traditional way, during a support case, not by an AI system. Google’s Chrome team likewise credited a human researcher, Salvatore Gulizia, with reporting the actively exploited V8 type-confusion flaw tracked as CVE-2026-85046 a full month before the September 3 patch shipped. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” Google Chrome’s Srinivas Sista wrote in the release notes, alongside eleven other high-severity fixes in the same update. That gap between disclosure and patch, roughly a month in Chrome’s case, is exactly the window that faster automated exploit development compresses on the attacker’s side without automatically compressing on the defender’s. If model-assisted attackers can go from a disclosed flaw to a working exploit in hours rather than weeks, a monthly patch cycle becomes a bigger liability than it already was, regardless of which lab’s model did the finding.
The skeptic’s case, stated plainly
The strongest counter-argument is that lab benchmarks are not the same as field results. Ninety-nine percent of what Mythos found is still unpatched and unverified against real attacker use. Astra’s ExploitGym score, the more realistic of OpenAI’s two benchmarks, is 42.4%, not 100%, meaning the model still fails on the majority of harder, more realistic exploit-development tasks. And CyberTech has previously reported that AI-generated malware volume has not shown up in telemetry at anything like the rate the capability announcements would predict, a gap that has held for months against a series of similarly dramatic vendor claims, including AI-generated exploit research aimed at Siemens PLCs earlier this year. Capability and deployed harm are not the same curve, and CISOs who over-rotate on this week’s benchmark risk under-investing in the boring controls, patch cadence, asset inventory, network segmentation, that catch both AI-assisted and conventional intrusions equally well.
What to do now
Treat this as a signal to act on two fronts rather than one. First, if your organization fits OpenAI’s Daybreak criteria, water and wastewater, electric grid, community banking, state and local government, or open-source maintenance, evaluate the program directly rather than waiting for a reseller pitch; the subsidy window is explicitly time-boxed to six months. Second, and regardless of eligibility, use this announcement as the forcing function to shorten your own patch SLA for anything with recent CVE activity in the affected code paths, particularly browsers and edge network infrastructure, since the corroborated pattern across both the Chrome and Cisco advisories this week is that human-discovered flaws are still sitting in production for weeks before a fix ships. The AI capability gap between finding a bug and weaponizing it is closing. The gap between disclosure and patching, the one your team actually controls, is not closing on its own.
Source: Anthropic
