{"id":237288,"date":"2026-06-25T16:04:00","date_gmt":"2026-06-25T20:04:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/25\/ai-makes-the-cybersecurity-game-faster-not-new\/"},"modified":"2026-06-25T16:05:38","modified_gmt":"2026-06-25T20:05:38","slug":"ai-makes-the-cybersecurity-game-faster-not-new","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/25\/ai-makes-the-cybersecurity-game-faster-not-new\/","title":{"rendered":"AI Makes the Cybersecurity Game Faster, Not New"},"content":{"rendered":"

AI Makes the Cybersecurity Game Faster, Not New<\/a><\/p>\n

https:\/\/www.rstreet.org\/commentary\/ai-makes-the-cybersecurity-game-faster-not-new\/<\/a><\/p>\n

Publish Date: 2026-06-25 16:04:00<\/a><\/p>\n

Source Domain: www.rstreet.org<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

AI tools continue to grow more advanced, which simultaneously increases the speed at which attackers can find and exploit cyber vulnerabilities, and defenders can both find and patch them. The longer it takes for defenders\u2014including banks, hospitals, and utilities\u2014to access to the most powerful cybersecurity tools, the longer they will be vulnerable to potential attackers working overtime to develop or obtain ever-more-capable AI systems\u2014whether nation-states or rogue criminal actors.<\/p>\n

Attackers will push on with their objectives regardless of whether public access to frontier AI models is slowed in the U.S., and they hope to use advanced AI to conduct espionage, hold critical infrastructure ransom, commit financial fraud, and more. The public debate\u00a0surrounding highly capable AI tools should not be about whether they should exist, but about who gets to them first. And that debate is catching headlines with the pending and uncertain rollout of the Anthropic AI model, Mythos.<\/p>\n

Anthropic recently\u00a0announced\u00a0a public \u201cMythos-class model\u201d called Fable 5, which the company says includes \u201csafeguards\u201d against using the model\u2019s most advanced cyber vulnerability-detection capabilities. Mythos-class models are general-purpose models like their predecessors, and Anthropic says Mythos\u2019 ability to detect cyber bugs is the driving force behind the phased launch. When the company\u2019s Project Glasswing\u2014Anthropic\u2019s roadmap for a tiered and gradual release of Mythos\u2014was announced in April, Mythos was\u00a0available\u00a0to a limited 50 organizations. It has since expanded to 200, but Anthropic\u00a0paused\u00a0the rollout of both after a federal decision barring foreign nationals from using the models.<\/p>\n

Anthropic says the tiered rollout is designed to prevent its model from getting into the hands of cyberattackers. And while attackers obtaining access to powerful AI models could pose profound risks, with the emergence of new software bugs remaining unavoidable, the formula for mitigating these risks is not inherently new. There is a more effective strategy\u00a0for combatting cybersecurity threats than tiering access to the leading tools.<\/p>\n

Advanced AI becoming more capable of finding bugs does not fundamentally change the underlying cybersecurity formula: software bugs create exploitation opportunities for hackers seeking to gain entry, and to prevent this, defenders must find and patch those vulnerabilities before they can be exploited. And with software bugs being inevitable, while AI tools are growing more capable of discovering them, those bugs were already there, and new ones will continue to arise.<\/p>\n

This dynamic intensifies in the age of agentic AI, which are systems that can execute goals autonomously with limited human intervention. Agentic AI can be prompted to carry out tasks, pursue objectives, and take actions on its own in a multi-step fashion, often much faster than people can. This changes the speed at which gaps can be found and patched, and wielding advanced AI capable of matching that pace is key to defenders outpacing attackers.<\/p>\n

The Parity Problem<\/p>\n

While Mythos is certainly more capable at uncovering cyber vulnerabilities than previous models, according to testing, Anthropic\u2019s Opus 4.6 scored 66.6% to Mythos Preview\u2019s 83.1% on the CyberGym cybersecurity vulnerability reproduction benchmark. CyberGym is a benchmark\u00a0developed at the University of California, Berkeley to evaluate the capabilities of AI agents on real-world cyber vulnerabilities. That\u2019s not an insignificant difference, but this publicly available model is also highly capable. And there are already real-life examples\u00a0of existing models rivaling many of the capabilities demonstrated by Mythos.<\/p>\n

Aisle, a vulnerability remediation startup, tested\u00a0open-source models to see if they could match the capability that shook markets in April when Anthropic demonstrated Mythos ability to identify cybersecurity flaws. Aisle ran what it describes as \u201ccheap, open-weights models\u201d on the same relevant code. These open-source models were shown to be just as capable of uncovering many vulnerabilities\u2014and completed the task for much cheaper. \u201cEight out of eight models detected Mythos\u2019s flagship FreeBSD exploit,\u201d said Aisle, \u201cincluding one with only 3.6 billion active parameters costing $0.11 per million tokens. A 5.1B-active open model recovered the core chain of the 27-year-old OpenBSD bug.\u201d<\/p>\n

Attackers having access to models at capability parity to frontier models is no longer theoretical. The evidence already suggests that open-source models are at least\u00a0matching Mythos on identifying certain cybersecurity flaws. In fact, Aisle says small open models outperformed frontier ones from \u201calmost every lab\u201d on one basic security reasoning task.<\/p>\n

The dynamism of global AI advancement doesn\u2019t stop there. Sakana AI, a Japan-based AI developer, recently said\u00a0its new model, Fugu, a multi-agent orchestration system designed to operate around export controls, \u201cmatches the performance of Fable and Mythos.\u201d And adversarial nation-states like China are continuing full steam ahead in their advanced AI ambitions, as evidenced by the autocracy\u2019s continued AI gains\u00a0despite U.S. export controls.<\/p>\n

U.S. AI development does not exist in a vacuum, and tiering access to frontier models across the American AI industry is not preventing attackers from obtaining AI models highly capable of identifying cybersecurity flaws. It is, however, preventing those defenders not lucky enough to be selected from having access to those frontier models to scan their code and find cyber vulnerabilities now.<\/p>\n

Tiered Access Picks Winners and Losers, Inhibits Innovation<\/p>\n

When access to frontier models is tiered or restricted instead of determined by the market, the little guy tends to lose\u2014whether those decisions are made by a private company or a regulatory body. Given the vast number of organizations with defensive cybersecurity needs, in a tiered system, some are bound to get left behind.<\/p>\n

Not only does this dynamic disadvantage the many and smaller over the select few, but it often makes bureaucrats and politicians (commonly, bureaucrats and politicians who misunderstand the technology) or the largest firms the driving forces behind advanced AI development over the market. Rather than the best and most consumer-favored AI model for defensive cybersecurity winning the day, the market becomes distorted toward those arbitrarily chosen by government officials.<\/p>\n

This cuts against competition between AI developers and risks hindering innovation. When companies are being rewarded for offering what consumers decide is the best model for their cybersecurity needs, competitors are incentivized to invest in resources aimed at achieving a superior model. In contrast, a regulatory architecture of picking winners and losers incentivizes companies to pivot resources away from things like research and development (R&D) and security improvements toward compliance, legal, and public relations to gain or remain in favor.<\/p>\n

In the latter system, firms that are larger and first-movers often get the upper hand in establishing industry standards. And these de facto standards are not always aligned with what is best for advancing cybersecurity technology. These firms can more easily afford to staff up on lawyers, lobbyists, and public relations professionals while startups are just getting off the ground. Raising the regulatory bar for competing in the arena risks arbitrarily tying up smaller and newer firms in red tape, stifling competition and enabling larger firms to become complacent. <\/p>\n

The pattern where larger firms often win out as part of tiered access projects is already happening in practice. Anthropic\u2019s Project Glasswing, while gradually expanding, has heavily favored early access for larger and well-known companies. Similarly, just last month, as part of its GPT-5.5-Cyber release, OpenAI also announced\u00a0it would be initially rolling out the model to a \u201cvetted\u201d group of defenders, many of which overlap with the former list. This is not to single out any particular AI lab, but to point to a growing impulse across the American AI industry.<\/p>\n

Significantly, Project Glasswing and the public release of Fable 5 were followed by the recent to block foreign nationals from using Fable and Mythos. This decision was an attempt to prevent Anthropic\u2019s most capable models from being weaponized by malicious actors, but in practice, resulted in all users being shut out, including defenders, both domestic and allied.<\/p>\n

And as companies await private tiered access expansion and a federal decision on a particular model\u2019s public availability, open-source models with competing capabilities remain available to attackers hoping to exploit vulnerabilities that defenders could be using those frontier models to patch in real time.<\/p>\n

Wide Access to Frontier Models Better Prepares Defenders for Faster Pace of Cybersecurity<\/p>\n

Consider the bank you have your primary checking account with and assume both this bank and an attacker have access to the same advanced AI system, with both seeking out the bank\u2019s cyber vulnerabilities. Here, the bank has the clear advantage: it can deploy the model to directly scan its source code internally and in real time.<\/p>\n

This enables the bank to outpace attackers, whether nation-states, organized crime, or lone hackers. Broad access to the most advanced AI enables banks, utility providers, cloud platforms, and others to preventively and continuously scan for and patch cyber gaps before attackers can exploit them.<\/p>\n

The advantages of remediation in cybersecurity\u2014closing a security flaw before it can be exploited\u2014also manifest themselves in open-source projects. When Mythos Preview famously\u00a0discovered\u00a0a 27-year-old bug in OpenBSD, an open-source operating system that\u00a0prides\u00a0itself on openness as a security strategy, many panicked. But this too makes the case for wide access to the most advanced AI systems.<\/p>\n

OpenBSD is known for being one of the most\u00a0secure\u00a0operating systems, and yet, even some of the best engineers in the world still missed this one for 27 years. While it is true that when code is public, it is available to both attackers and defenders, attackers can still only exploit vulnerabilities. Defenders can permanently patch them. And this is not an indictment against open-source software as a security strategy. It is quite the contrary. Wide access to the most advanced AI systems builds upon the open-source security concept, equipping an extensive range of defenders, both small and large, with cutting-edge tools and strengthening their ability to find and close those gaps.<\/p>\n

Regulators should resist pressure to arbitrarily tier access to AI models and to restrain models themselves. The United States still holds the edge in AI technology but must not become complacent or forget how we got here. Constraining industry-leading AI inhibits one of America\u2019s greatest advantages: an unleashed private sector. <\/p>\n

The many entrepreneurs and engineers working and competing across firms are far better positioned to evaluate risk, set up defenders for success, and sustain America\u2019s cyber edge than an advisory group of bureaucrats and politicians. Lawmakers shouldn\u2019t stand in between cyber-defenders and the most capable tools for patching gaps today by centralizing AI and cybersecurity policymaking. A more effective approach is to keep innovation at the forefront by adopting a policy of open and market-based access to the ever-evolving premier AI cyber tools.<\/p>\n

\t\tSubscribe to our policy work\t\t<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

AI Makes the Cybersecurity Game Faster, Not New https:\/\/www.rstreet.org\/commentary\/ai-makes-the-cybersecurity-game-faster-not-new\/ Publish Date: 2026-06-25 16:04:00 Source Domain:…<\/p>\n","protected":false},"author":1,"featured_media":237289,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.rstreet.org\/wp-content\/uploads\/2020\/09\/cybersecurity-national-security-technology-scaled-1.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,24,31,27],"class_list":["post-237288","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-cybersecurity","tag-exploit","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/237288"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=237288"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/237288\/revisions"}],"predecessor-version":[{"id":237290,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/237288\/revisions\/237290"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/237289"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=237288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=237288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=237288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}