KI , Angie & Tenniel

The model can systematically analyze large codebases, identify vulnerabilities, and in some cases even infer how they can be exploited or fixed. In concrete terms, this means: AI is changing roles. It is no longer just an assistive tool that provides helpful suggestions. It is becoming an active participant in security analysis. But the key point is not its performance—it is its speed. What used to take human teams days or weeks can now be done in hours, using significant computational resources. At first glance, this sounds like progress—and it is. But progress works both ways. The window between discovering a vulnerability and its potential exploitation is shrinking, because AI also makes it possible to quickly develop corresponding malicious code.

Open source thrives on transparency. Anyone can read, review, and improve the code. This is its great strength—and exactly where the problem lies. This openness applies not only to defenders, but also to attackers. Those searching for vulnerabilities find them faster, regardless of which side they are on. Every code change is publicly visible and usually well documented in developer discussions. And the way some open-source projects make decisions does not make this any easier. Code changes are reviewed by maintainers, reviewers, and community processes. This is a good thing, as it ensures quality. But it takes time—time that becomes a real risk in an AI-accelerated threat landscape.

Claude Mythos Preview is currently not freely accessible to everyone. In just a few weeks, the model has found a large number of zero-day vulnerabilities (previously undiscovered security flaws) across all major operating systems and browsers—including issues that had survived decades of human review and millions of automated tests. It was not only able to identify unknown vulnerabilities, but also to turn them into functioning attack tools. In the hands of non-experts with criminal intent, this would be highly concerning.

Too dangerous for everyone

Claude Mythos Preview is intended to be made available exclusively to selected large technology companies. They can use the new model to secure their own systems, analyze their codebases, and improve their infrastructure. This advantage is denied to others. As so often, power lies with the big tech corporations. This is not a new insight—but here it takes on a new dimension. In the past, the advantage was primarily financial: more developers, more budget, more infrastructure. This could at least partially be offset through smart open-source collaboration—many eyes see more than a few. But now something fundamental is shifting. It is no longer just about resources, but about the speed of analytical capability. And that cannot be compensated for by volunteer effort.

Concretely, this means: a single well-resourced corporation with access to Claude Mythos can scan its entire codebase for vulnerabilities in a fraction of the time it would take an open-source project with ten active maintainers months to achieve. This is not a question of effort or willingness. It is a question of access.

The imbalance does not arise from attacks. It arises from an unequal distribution of defensive capability. Those with better tools secure their systems faster. The gap grows—silently.

Open-source projects may fall behind, not because they are worse, but because others are faster. That is the real issue. Whether corporations will ever actively use this advantage against competitors remains speculation. There is no evidence of that. But that is almost beside the point. The asymmetry is already emerging—quietly, without attack, without malicious intent. Simply through the fact that some actors have access to tools that others do not. The technology is becoming more powerful. Access remains selective. And it is precisely this combination that could, in the long term, be just as security-relevant as the models themselves.