AI tools continue to grow more advanced, which simultaneously increases the speed at which attackers can find and exploit cyber vulnerabilities, and defenders can both find and patch them. The longer it takes for defenders—including banks, hospitals, and utilities—to access to the most powerful cybersecurity tools, the longer they will be vulnerable to potential attackers working overtime to develop or obtain ever-more-capable AI systems—whether nation-states or rogue criminal actors.

Attackers will push on with their objectives regardless of whether public access to frontier AI models is slowed in the U.S., and they hope to use advanced AI to conduct espionage, hold critical infrastructure ransom, commit financial fraud, and more. The public debate surrounding highly capable AI tools should not be about whether they should exist, but about who gets to them first. And that debate is catching headlines with the pending and uncertain rollout of the Anthropic AI model, Mythos.

Anthropic recently announced a public “Mythos-class model” called Fable 5, which the company says includes “safeguards” against using the model’s most advanced cyber vulnerability-detection capabilities. Mythos-class models are general-purpose models like their predecessors, and Anthropic says Mythos’ ability to detect cyber bugs is the driving force behind the phased launch. When the company’s Project Glasswing—Anthropic’s roadmap for a tiered and gradual release of Mythos—was announced in April, Mythos was available to a limited 50 organizations. It has since expanded to 200, but Anthropic paused the rollout of both after a federal decision barring foreign nationals from using the models.

Anthropic says the tiered rollout is designed to prevent its model from getting into the hands of cyberattackers. And while attackers obtaining access to powerful AI models could pose profound risks, with the emergence of new software bugs remaining unavoidable, the formula for mitigating these risks is not inherently new. There is a more effective strategy for combatting cybersecurity threats than tiering access to the leading tools.

Advanced AI becoming more capable of finding bugs does not fundamentally change the underlying cybersecurity formula: software bugs create exploitation opportunities for hackers seeking to gain entry, and to prevent this, defenders must find and patch those vulnerabilities before they can be exploited. And with software bugs being inevitable, while AI tools are growing more capable of discovering them, those bugs were already there, and new ones will continue to arise.

This dynamic intensifies in the age of agentic AI, which are systems that can execute goals autonomously with limited human intervention. Agentic AI can be prompted to carry out tasks, pursue objectives, and take actions on its own in a multi-step fashion, often much faster than people can. This changes the speed at which gaps can be found and patched, and wielding advanced AI capable of matching that pace is key to defenders outpacing attackers.

The Parity Problem

While Mythos is certainly more capable at uncovering cyber vulnerabilities than previous models, according to testing, Anthropic’s Opus 4.6 scored 66.6% to Mythos Preview’s 83.1% on the CyberGym cybersecurity vulnerability reproduction benchmark. CyberGym is a benchmark developed at the University of California, Berkeley to evaluate the capabilities of AI agents on real-world cyber vulnerabilities. That’s not an insignificant difference, but this publicly available model is also highly capable. And there are already real-life examples of existing models rivaling many of the capabilities demonstrated by Mythos.

Aisle, a vulnerability remediation startup, tested open-source models to see if they could match the capability that shook markets in April when Anthropic demonstrated Mythos ability to identify cybersecurity flaws. Aisle ran what it describes as “cheap, open-weights models” on the same relevant code. These open-source models were shown to be just as capable of uncovering many vulnerabilities—and completed the task for much cheaper. “Eight out of eight models detected Mythos’s flagship FreeBSD exploit,” said Aisle, “including one with only 3.6 billion active parameters costing $0.11 per million tokens. A 5.1B-active open model recovered the core chain of the 27-year-old OpenBSD bug.”

Attackers having access to models at capability parity to frontier models is no longer theoretical. The evidence already suggests that open-source models are at least matching Mythos on identifying certain cybersecurity flaws. In fact, Aisle says small open models outperformed frontier ones from “almost every lab” on one basic security reasoning task.

The dynamism of global AI advancement doesn’t stop there. Sakana AI, a Japan-based AI developer, recently said its new model, Fugu, a multi-agent orchestration system designed to operate around export controls, “matches the performance of Fable and Mythos.” And adversarial nation-states like China are continuing full steam ahead in their advanced AI ambitions, as evidenced by the autocracy’s continued AI gains despite U.S. export controls.

U.S. AI development does not exist in a vacuum, and tiering access to frontier models across the American AI industry is not preventing attackers from obtaining AI models highly capable of identifying cybersecurity flaws. It is, however, preventing those defenders not lucky enough to be selected from having access to those frontier models to scan their code and find cyber vulnerabilities now.

Tiered Access Picks Winners and Losers, Inhibits Innovation

When access to frontier models is tiered or restricted instead of determined by the market, the little guy tends to lose—whether those decisions are made by a private company or a regulatory body. Given the vast number of organizations with defensive cybersecurity needs, in a tiered system, some are bound to get left behind.

Not only does this dynamic disadvantage the many and smaller over the select few, but it often makes bureaucrats and politicians (commonly, bureaucrats and politicians who misunderstand the technology) or the largest firms the driving forces behind advanced AI development over the market. Rather than the best and most consumer-favored AI model for defensive cybersecurity winning the day, the market becomes distorted toward those arbitrarily chosen by government officials.

This cuts against competition between AI developers and risks hindering innovation. When companies are being rewarded for offering what consumers decide is the best model for their cybersecurity needs, competitors are incentivized to invest in resources aimed at achieving a superior model. In contrast, a regulatory architecture of picking winners and losers incentivizes companies to pivot resources away from things like research and development (R&D) and security improvements toward compliance, legal, and public relations to gain or remain in favor.

In the latter system, firms that are larger and first-movers often get the upper hand in establishing industry standards. And these de facto standards are not always aligned with what is best for advancing cybersecurity technology. These firms can more easily afford to staff up on lawyers, lobbyists, and public relations professionals while startups are just getting off the ground. Raising the regulatory bar for competing in the arena risks arbitrarily tying up smaller and newer firms in red tape, stifling competition and enabling larger firms to become complacent.

The pattern where larger firms often win out as part of tiered access projects is already happening in practice. Anthropic’s Project Glasswing, while gradually expanding, has heavily favored early access for larger and well-known companies. Similarly, just last month, as part of its GPT-5.5-Cyber release, OpenAI also announced it would be initially rolling out the model to a “vetted” group of defenders, many of which overlap with the former list. This is not to single out any particular AI lab, but to point to a growing impulse across the American AI industry.

Significantly, Project Glasswing and the public release of Fable 5 were followed by the recent to block foreign nationals from using Fable and Mythos. This decision was an attempt to prevent Anthropic’s most capable models from being weaponized by malicious actors, but in practice, resulted in all users being shut out, including defenders, both domestic and allied.

And as companies await private tiered access expansion and a federal decision on a particular model’s public availability, open-source models with competing capabilities remain available to attackers hoping to exploit vulnerabilities that defenders could be using those frontier models to patch in real time.

Wide Access to Frontier Models Better Prepares Defenders for Faster Pace of Cybersecurity

Consider the bank you have your primary checking account with and assume both this bank and an attacker have access to the same advanced AI system, with both seeking out the bank’s cyber vulnerabilities. Here, the bank has the clear advantage: it can deploy the model to directly scan its source code internally and in real time.

This enables the bank to outpace attackers, whether nation-states, organized crime, or lone hackers. Broad access to the most advanced AI enables banks, utility providers, cloud platforms, and others to preventively and continuously scan for and patch cyber gaps before attackers can exploit them.

The advantages of remediation in cybersecurity—closing a security flaw before it can be exploited—also manifest themselves in open-source projects. When Mythos Preview famously discovered a 27-year-old bug in OpenBSD, an open-source operating system that prides itself on openness as a security strategy, many panicked. But this too makes the case for wide access to the most advanced AI systems.

OpenBSD is known for being one of the most secure operating systems, and yet, even some of the best engineers in the world still missed this one for 27 years. While it is true that when code is public, it is available to both attackers and defenders, attackers can still only exploit vulnerabilities. Defenders can permanently patch them. And this is not an indictment against open-source software as a security strategy. It is quite the contrary. Wide access to the most advanced AI systems builds upon the open-source security concept, equipping an extensive range of defenders, both small and large, with cutting-edge tools and strengthening their ability to find and close those gaps.

Regulators should resist pressure to arbitrarily tier access to AI models and to restrain models themselves. The United States still holds the edge in AI technology but must not become complacent or forget how we got here. Constraining industry-leading AI inhibits one of America’s greatest advantages: an unleashed private sector.

The many entrepreneurs and engineers working and competing across firms are far better positioned to evaluate risk, set up defenders for success, and sustain America’s cyber edge than an advisory group of bureaucrats and politicians. Lawmakers shouldn’t stand in between cyber-defenders and the most capable tools for patching gaps today by centralizing AI and cybersecurity policymaking. A more effective approach is to keep innovation at the forefront by adopting a policy of open and market-based access to the ever-evolving premier AI cyber tools.