This is kind of a nothingburger, no? I feel like the (Reddit) title is a bit disingenuous, or at the very least lacks the proper context.

• Questionable methodology, as alluded to by other commenters. They're giving the model the vulnerable function and asking it to identify the vulnerability versus giving it the whole codebase to discover. At this point I would expect most models to be able to identify an issue with a code, if I went and gave it only the function that I know had an issue.

• By the article's own statement, they're not saying that smaller models are just as capable as Mythos. They're just saying that the ability for a model to identify and fix a vulnerability is not exclusive to Mythos, which is a bit misleading given the previous point.

• Doing a bit of source criticism: AISLE is a company that does security analysis and vulnerability remediation. They're making claims about a competitor, saying "it's nothing special" and "given the right tooling, we can match what Mythos claims to do".

Quote:

But the strongest version of the narrative, that this work fundamentally depends on a restricted, unreleased frontier model, looks overstated to us. If taken too literally, that framing could discourage the organizations that should be adopting AI security tools today, concentrate a critical defensive capability behind a single API, and obscure the actual bottleneck, which is the security expertise and engineering required to turn model capabilities into trusted outcomes at scale.

What appears broadly accessible today is much of the discovery-and-analysis layer once a good system has narrowed the search. The evidence we've presented here points to a clear conclusion: discovery-grade AI cybersecurity capabilities are broadly accessible with current models, including cheap open-weights alternatives. The priority for defenders is to start building now: the scaffolds, the pipelines, the maintainer relationships, the integration into development workflows. The models are ready. The question is whether the rest of the ecosystem is.

We think it can be. That's what we're building.

Or more accurately:

This product announcement may affect our bottom line, here's how we can replicate the results using tooling/scaffolding/pipelines to isolate the vulnerable code to pass to an less powerful LLM to fix (which also happens to be what we market ourself as our differentiator with our "Cyber Reasoning System").

Do I believe Mythos is this crazy powerful model that will allow the common layperson to discover 200 zero days and take over the world? No. Do I believe that smaller/local LLMs are as powerful as Mythos in the same context? Also no.

Media literacy is at all time low.