Faster attacks, quicker exploits: Early testers of new AI models warn of their new abilities

Anthropic and OpenAI have released new cyber-capable models — Mythos and GPT-5.4-Cyber, respectively — to early testers including security researchers at financial institutions. Axios reports that these testers have observed the models can perform hacking tasks faster and at greater scale than previous versions. Specific capabilities include turning disclosed Common Vulnerabilities and Exposures (CVEs) into working, scalable exploits within weeks of model release.

The models are part of a broader trend of LLM developers offering specialised AI tools for cybersecurity, primarily marketed as defensive aids. However, the reported ability to go from vulnerability notification to code execution in a much shorter time frame raises concerns about dual-use risk. According to Axios, at least one independent security researcher confirmed they could achieve remote code execution on a target system by feeding a CVE description to the model — a task that previously required human reverse-engineering.

OpenAI and Anthropic have implemented tiered access controls and monitoring for these cyber models, but the speed at which testers have pushed the tools to offensive use has sparked discussion about adequacy of safeguards. Neither company has commented publicly on the specific findings, and the implications for existing vulnerability disclosure practices and network defence remain debated among security professionals. The issue represents an early empirical test of tensions between AI-as-defence and AI-as-easy-offence capability trends.