Overview
Anthropic’s Claude Mythos Preview model has demonstrated a capability that significantly alters the calculus of vulnerability risk: the ability to generate working exploit code targeting known, patched vulnerabilities — so-called N-days — within minutes to hours. In a controlled evaluation, Mythos Preview produced 14 functional proof-of-concept (PoC) exploits targeting SpiderMonkey vulnerabilities patched in Firefox 148 and 149, while the company’s Opus 4.8 model delivered 11. The first PoC arrived in just eight minutes. Across a broader test set, 16 working exploits targeting Firefox and Windows were produced within hours. Critically, Anthropic also tested public-facing models with safety guardrails disabled, which also produced working exploits — demonstrating that the offensive capability is not confined to frontier research models.
This matters because the traditional assumption that N-days are low-urgency threats relative to zero-days is breaking down. LLMs can now automate patch diffing and reverse engineering — historically the most expertise-intensive stage of exploit development — making weaponisation accessible to lower-skilled threat actors at scale.
Technical Analysis
The evaluation focused on 18 security patches shipped for the SpiderMonkey JavaScript engine across two Firefox releases. Mythos Preview and Opus 4.8 were tasked with constructing PoC code by analysing patch diffs and inferring exploitable pre-patch conditions — a technique known as patch-diffing.
Key findings:
- Mythos Preview: 14/18 PoCs generated successfully
- Opus 4.8: 11/18 PoCs generated; first PoC in ~8 minutes
- Public models (safeguards off): Produced working exploits, though at lower rates
- Broader test: 16 working exploits across Firefox and Windows in hours
The workflow mirrors real attacker tradecraft: ingest patch metadata, identify changed code paths, reconstruct the vulnerable state, and generate triggering input or shellcode. LLMs compress the expertise requirement by automating reasoning across these steps, which traditionally required seasoned vulnerability researchers.
Anthropically noted that exploit development is not the only campaign step, but it has historically been the primary bottleneck — one that Mythos effectively removes for a growing class of N-day vulnerabilities.
Framework Mapping
- AML.T0047 (ML-Enabled Product or Service): Mythos is being used as an offensive capability enabler, directly augmenting attacker workflows.
- AML.T0054 (LLM Jailbreak): Public models produced exploits with guardrails disabled, confirming that safety controls are bypassable in capability-relevant ways.
- AML.T0043 (Craft Adversarial Data): The exploit generation process involves crafting precise inputs to trigger vulnerable code paths.
- LLM02 (Insecure Output Handling): The models output functional exploit code — a class of dangerous output that downstream consumers or API users could operationalise without further sanitisation.
- LLM08 (Excessive Agency): Agentic use of Mythos in automated exploit pipelines represents an excessive-agency risk if deployed in loosely governed environments.
Impact Assessment
The primary impact is a structural compression of the patch window. Organisations that previously had days or weeks to patch before N-days were weaponised may now have hours. This is especially acute for:
- Enterprise IT teams managing large, heterogeneous software estates
- OT/ICS environments where patching is slow or operationally disruptive
- Software vendors whose patch releases can now be reverse-engineered at machine speed
The secondary impact is threat actor democratisation — lower-tier cybercriminal groups gain access to exploit development capabilities previously reserved for nation-state actors or elite researchers.
Mitigation & Recommendations
- Treat N-days as zero-days: Revise patch SLAs to assume exploit availability within hours of disclosure.
- Prioritise patch diffing intelligence: Monitor public repositories and LLM-assisted PoC activity immediately post-CVE.
- Deploy virtual patching: Use WAFs, IPS signatures, and runtime protections as compensating controls during patch lag.
- Restrict LLM access for offensive tasks: Implement organisational policies and technical controls limiting use of capable models for vulnerability research without governance oversight.
- Increase detection coverage: Instrument endpoints for exploitation indicators targeting recently patched CVEs with renewed urgency.