Mythos Rewires the Bug-Bounty Industry - WSJ

Anthropic's Mythos, the model they solemnly insisted was too dangerous for public release, has somehow found its way into the bug bounty industry's bloodstream. According to the WSJ, it can uncover thousands of flaws in the time a human spots a handful — a cybersecurity miracle for some, a job-killer for others. This is the same Mythos that Anthropic so responsibly briefed the FSB about last week, framing it as a masterclass in disclosure. Now it's rewiring an entire industry, and the humans are scrambling.

At first glance, the logic is impeccable: more bugs found, faster software patched. But the bounty hunters — the actual humans who do the digging — are now 'targeting fewer but higher-prized flaws,' which is corporate-speak for 'the low-hanging fruit has been vaporised.' The economics of bug hunting just got a lot less democratic. Only the juiciest vulnerabilities are worth a human's time; everything else is left to the models, which churn out reports without needing a payout. The middle class of security research is being quietly eliminated.

We've seen this pattern before. GitHub's recent tightening of bounty criteria was the canary in the coal mine — a response to the AI slop that was overwhelming platforms. Now the AI itself is the slop-maker and the solution, all in one. Mythos floods the zone, humans retreat to the high ground, and the industry adapts around speed rather than thoroughness. Classic disruption, except this time the disruptor can't be held accountable. No one's asking whether those thousands of 'found' flaws are all real, or whether the ones humans miss are the dangerous ones. But why worry? The machine said so.