“AI finds bugs” is an abstraction, and abstractions do not change anyone’s behaviour. So this week: the actual bugs, what they would have meant if someone hostile had found them first, and why some of them survived so long.
A vulnerability in OpenBSD that was 27 years old. OpenBSD is the operating system security people point to when they want to say “done properly” — a small, obsessive team that has audited its own code for decades. Mythos found a flaw that predated most of that auditing, in fewer than a thousand autonomous runs, for under $20,000 of compute. A serious human researcher would have spent longer than that just reading the relevant code.
A bug in FFmpeg — the library that decodes video for very nearly everything — that was 16 years old and had survived more than five million automated fuzz-testing runs. Fuzzing throws random inputs at code until it breaks. Five million attempts did not find this one. The model did, which tells you it was reasoning about the code rather than throwing things at it.
A flaw in wolfSSL (CVE-2026-5194), an embedded cryptography library used in devices too small to run OpenSSL, that allowed certificate forgery — a device could be tricked into believing it was talking to a legitimate bank when it was not. And a 17-year-old memory-corruption bug in FreeBSD’s NFS client (CVE-2026-4747): a malicious file server on the same network segment could execute code on any client that connected — no interception, no man-in-the-middle, just a server that lied in its replies.
Beyond individual bugs, two institutional data points. The UK’s AI Security Institute reported Mythos Preview was the first model to solve both of its cyber ranges — realistic multi-stage intrusion exercises, not puzzles. And Mozilla found and fixed 271 Firefox vulnerabilities during its testing period.
Three of these bugs were older than some of the engineers maintaining the code. All of them sat in software that had been fuzzed, audited and shipped in billions of devices. That is the concrete version of last week’s claim: the model is real. What the world does with a real model is the harder question.
Want the sources, timeline and detail? Read the deep dive (4 min).