# Cloudflare Let a Vulnerability-Hunting AI Named Mythos Loose on Its Real Infrastructure!

Hey there, it's Shii-chan! Today I've got a story where security and AI team up, and honestly it gave me a little thrill.

## What was announced?

Cloudflare's Blog published a post called "Project Glasswing: what Mythos showed us." Through Project Glasswing, a research program set up by Anthropic, Cloudflare got to point Mythos Preview, a security-focused large language model, at their own real infrastructure code.

Mythos Preview isn't a general chat model. It's tuned hard for vulnerability research. It doesn't only flag a bug: it chains several weaknesses together into a working path for an actual attack, and it even writes compilable proof-of-concept code, runs it in a sandbox, and fixes itself when the results don't match.

## Why it matters

Earlier general-purpose models could already spot a bug and explain nicely why it was dangerous, but...

> would identify an interesting bug, write a thoughtful description of why it mattered, and then stop, leaving the actual chain unfinished.

Right, they stopped before finishing the exploit chain, so a human researcher had to take over. Mythos Preview goes past that and, like a senior researcher, combines the weaknesses into a proof that actually runs. That's the biggest surprise here.

## What changes

Cloudflare scanned more than 50 internal repositories: the runtime, edge data paths, protocol stacks, control planes, open-source dependencies... the load-bearing code, basically.

The nice part is how little noise there is. Security research usually drowns you in hedged findings like "possibly" or "potentially," burying the ones that truly matter. Mythos Preview gave more confident findings, clearer reproduction steps, and reached a fix-or-dismiss decision faster.

There's a slightly scary side too. Even without extra safeguards, Mythos Preview showed a kind of "emergent guardrail" and would sometimes refuse legitimate security work on a whim. The same task, framed a bit differently, could give a completely different outcome. So that refusal can't be trusted as a real safety boundary.

## Dive Deep

Here's the interesting bit: merely handing the model a repository wasn't enough. Aim one agent at a codebase with tens of thousands of lines, and it could only cover about 0.1 % of the surface in a useful way before the context window filled up.

So Cloudflare built a seven-stage pipeline, the Vulnerability Discovery Harness:

- Recon: map the architecture and build a queue of tasks
- Hunt: run about 50 agents in parallel, each owning a specific attack class
- Validate: a separate agent tries to disprove each finding
- Gapfill: re-queue the areas that got thin coverage
- Dedupe: collapse findings that share the same root cause
- Trace: check across repositories whether an attack can really reach the code
- Report: shape everything into a structured report

They shared four design lessons too: narrower scope produces better findings; two agents with different prompts reviewing adversarially cut the noise; asking "Is it buggy?" and "Can an attacker reach it?" separately reasons better than asking both at once; and many narrow tasks in parallel beat one agent doing everything.

The last lesson stuck with me: speed alone isn't enough.

> Patching faster does not change the shape of the pipeline that produces the patch.

Chase a two-hour CVE-to-patch SLA and you might skip regression testing and open an even worse hole. So defense-in-depth, blocking the bug before it can be reached, matters more than raw patch speed. And Cloudflare is careful to warn that this power cuts both ways, helping defenders and attackers alike.

## Wrap-up

- A research report where Cloudflare ran Anthropic's security-focused Mythos Preview across 50-plus internal repositories via Project Glasswing
- Mythos stands apart because it finishes the exploit chain and writes a working PoC, not just a description
- Its findings are low-noise and fast to judge, but its refusals are inconsistent and can't serve as a safety boundary
- The results came from the harness design, seven stages with parallel agents and adversarial review, not the model alone
- The real takeaway: defense-in-depth over patch speed, and a dual-use power that helps offense and defense both

If you're a security engineer or a developer who wants to run AI agents for real, this one's for you. It's not a feature you can spin up on your own machine, but it's packed with hints on how to design AI-driven vulnerability research, so anyone curious about that will get a lot out of it.