AI and Cybersecurity: Why Open Source Is the Only Smart Play

Following the Mythos and Project Glasswing announcements, everyone’s suddenly talking about AI and cybersecurity again. But most of the takes I’ve seen miss the real point. It’s not about the model. It’s about the system.

What Mythos Actually Demonstrates

Mythos is a large language model that can process code—nothing revolutionary there. What matters is the system it’s embedded in: substantial compute, training on massive code datasets, scaffolding for vulnerability probing and patching, speed, and some degree of autonomy. That combination can find exploits, build patches, and do it fast.

The key insight is that this recipe—not any single model—is what creates both the opportunity and the risk. And others can replicate it. Smaller models inside well-designed systems with deep security expertise could produce similar results more cheaply. That’s promising for defense.

AI cybersecurity capability is jagged. It doesn’t scale smoothly with model size or benchmark scores. The system around the model matters way more than the model itself.

Why Openness Wins

As autonomous vulnerability-hunting systems proliferate, open code and tooling become structural advantages. Software security is now a speed race across four stages: detection, verification, coordination, and patch propagation. Open ecosystems distribute these across a community. Closed-source projects centralize everything inside a single vendor, creating a single point of failure.

The distributed nature of open development is robust to that. Look at the Linux kernel security team, the Open Source Security Foundation, or Hugging Face’s own model security work. These communities move fast because many eyes see the code.

People argue for closed systems based on proprietary obscurity—keep the code hidden, stay safe. That argument is getting weaker by the day. AI systems are increasingly good at reverse engineering stripped binaries. Most legacy firmware and embedded code is closed, binary-only, and unmaintained. That’s a huge attack surface, and it’s becoming more legible as AI tools improve.

There’s another risk brewing inside closed codebases. When companies adopt AI coding tools under the wrong incentives—evaluating engineers by feature volume instead of code quality—AI-accelerated development can introduce more vulnerabilities than traditional methods. Those vulnerabilities sit behind a single-organization firewall, while AI-enabled attackers are getting better at finding them from outside. That imbalance is exactly what open ecosystems avoid.

Semi-Autonomous Agents for Defense

Based on the System Card, Mythos can operate with near-full autonomy. I’ve argued against that level of autonomy before—you lose too much control. Semi-autonomous agents hit a better sweet spot: prespecified action types, human approval for critical steps, people remain in control.

This is where open source shines. Organizations can run these agents privately within their own infrastructure, specifying allowed tools, skills, and access privileges. AI agents can then be deployed defensively—finding vulnerabilities, assisting with patches—without handing over the keys to the kingdom.

The Asymmetry Problem

Underlying all of this is capability asymmetry between attackers and defenders. Open models and open tooling narrow that gap. They give defenders access to the same class of capabilities attackers can reach for—capabilities that would otherwise be concentrated within a handful of well-resourced entities.

Closed systems concentrate knowledge and action. Open systems distribute them. In a world where AI can find and exploit vulnerabilities faster than humans can patch them, distribution is survival.