Beyond Model Restrictions: The Case For Arming Cyber Defenders With AI

During a time of constant Artificial Intelligence (AI) whiplash, it is helpful to step back and review what has happened since Anthropic announced Claude Mythos Preview in early April 2026. Examining just these few months can help policymakers, organizational leaders, and security teams internalize lessons learned and prioritize actions, regardless of the latest AI model incident, advancement, or letter from industry. In that vein, the following piece discusses how Mythos and other new frontier models have advanced vulnerability discovery speed and volume but failed to translate those gains into accelerated remediation. It notes the value of open-weight models and the systems that support model output, such as harnesses, and how they are approaching parity with closed models from Anthropic or OpenAI. The discussion pivots to real-world incidents, illustrating that the security environment has unequivocally changed, and the cybersecurity playbook of yesterday is no longer fit for purpose. The second half of the paper then shifts to the U.S. Government response, which has prioritized model restrictions rather than assistance to critical infrastructure entities that need help defending themselves. In conclusion, this paper calls for providing AI tools, services, and guidance to critical infrastructure as soon as possible through established government coordination bodies to bend the cyber advantage curve back to defenders.

A New Cybersecurity Environment

On June 22, 2026, the leaders of the Five Eyes cybersecurity agencies issued a united call to action for boards and executives to act swiftly–in months, not years–in the face of an evolving landscape of AI transforming cyber risk. As many security leaders and experts have observed, the legacy cybersecurity framework of finding, disclosing, and patching vulnerabilities deliberately and sequentially over weeks and months is fundamentally broken. Radical and immediate change is necessary, before advanced AI cyber capabilities are available to threat actors globally.

Frontier Models Accelerate Vulnerability Discovery But Remediation Lags

Prior to the Five Eyes announcement, on May 13, the United Kingdom’s (UK) AI Security Institute (AISI) assessed Anthropic’s Claude Mythos Preview and OpenAI’s GPT-5.5-Cyber models, concluding, “frontier AI’s autonomous cyber and software capability is advancing quickly: the length of cyber tasks that frontier models can complete autonomously has doubled on the order of months, not years.” 

Vulnerability discovery has stopped being the constraint. Validation, maintainer capacity, and patch absorption are now the limitations.

Then on May 22, Anthropic published an initial update from Project Glasswing, a cross-industry collaboration to secure critical software using Mythos Preview (Of note, Anthropic did not release the raw underlying data for these findings, a limitation several researchers have noted). According to Anthropic, Project Glasswing partner companies discovered hundreds of critical- or high-severity vulnerabilities in their own software and over ten thousand in total. The more consequential number, though, came from scanning over 1,000 open-source projects. Of the 23,019 total vulnerabilities discovered in those projects, 1,587 critical- or high-severity vulnerabilities were valid true positives, and Anthropic disclosed an estimated 530 of those bugs to maintainers. And yet, only 75 vulnerabilities had been patched at the time of the May 22 update. Several maintainers asked Anthropic to slow its rate of disclosure, citing capacity shortages in designing fixes. Vulnerability discovery has stopped being the constraint. Validation, maintainer capacity, and patch absorption are now the limitations. 

Beyond the Frontier: Harnesses and Open-Weight Models

The rapid progress in AI-enabled vulnerability discovery has not been unique to frontier AI models. Niels Provos demonstrated that frontier model cyber capabilities are within reach using a harness to manage commercially available AI models, such as Anthropic’s Claude Opus 4.6 and Sonnet 4.6, and replicate findings from proprietary frontier models like Mythos. A harness is the orchestration layer around a large language model (LLM) and enables the LLM to act on tasks by connecting it to tools, memory, workspace, and guardrails. Without a harness, a model can answer questions, but it can’t reliably run code, access files, remember prior work, or complete complicated workflows on its own. Or as Andy Gill helpfully noted, “picking the right model and ignoring the harness is like buying a race engine and fitting it to a shopping trolley.” Similarly, AI cybersecurity startup company Aisle has used widely available and open-source models paired with harnesses that the company claims can match or exceed the vulnerability findings in some open-source codebases achieved by Mythos. 

In June, a new Chinese open-weight model, GLM-5.2, emerged. The UK AISI assessed GLM-5.2 trailed frontier models by only four to seven months. According to evaluations by Graphistry and Semgrep, GLM-5.2 performed well compared to Opus 4.8 and GPT-5.5 models on cybersecurity investigation and vulnerability discovery benchmarks at half the cost. XBOW, an autonomous penetration testing company, described GLM-5.2 as not the next Mythos, “but it would have been if it had been released half a year earlier.”

More recently in mid-July, Chinese startup Moonshot AI released China’s largest open-weight AI model to date, called Kimi K3. The UK AISI and U.S. Center for AI Standards and Innovation (CAISI) conducted a joint evaluation of Kimi K3’s cyber capabilities and concluded it performed significantly below the most recent frontier cyber-capable models on preliminary cyber evaluations but above GLM-5.2. A few days after Kimi K3’s release, Alibaba followed with Qwen3.8-Max-Preview, a 2.4 trillion-parameter model second only to Anthropic’s Fable 5, though Alibaba did not disclose the benchmarks or model details (a high parameter count generally equates to better performance but requires more compute and memory). A researcher has already used Kimi K3 to discover new vulnerabilities in the wild. 

A cheaper, open-weight model that can be downloaded, controlled, and inspected by individual users to find zero-day vulnerabilities and create exploits without monitoring by frontier AI company infrastructure illustrates vividly how narrow the gap is between closed models like Mythos and the open model universe. A majority of AI production tokens now route through open-weight models, which are the most popular models on OpenRouter’s LLM usage leaderboard. And as of early July, six of the seven best open models across three evaluation indexes were Chinese, fueling concerns about possible supply chain, censorship, and counterintelligence risks for users entering sensitive information into these models with fewer guardrails. 

Methodically disclosing vulnerabilities to vendors and then patching them weeks or months later is no match for adversary AI models or agents conducting thousands of successive actions against a target that no human defender can counter effectively.

This lightning advancement in AI model cybersecurity task performance contextualizes the latest data depicted by the Zero Day Clock dashboard, which shows the mean gap between vulnerability public disclosure and the exploitation of that vulnerability in the wild is under one day. The cybersecurity environment is now one in which exploitation of vulnerabilities is the most common initial access vector for breaches, and vulnerabilities are being exploited less than one day after disclosure, often within hours. Meanwhile, the median time to fully resolve a vulnerability in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerability catalog has risen to 43 days from 32 days. Methodically disclosing vulnerabilities to vendors and then patching them weeks or months later is no match for adversary AI models or agents conducting thousands of successive actions against a target that no human defender can counter effectively.

Threat Realized: Real-World Incidents

Recent cyber incidents demonstrate the new threat environment is more than hypothetical. In May, The Google Threat Intelligence Group identified a threat actor using a zero-day exploit they believe was developed with AI but prevented the attack. Just two months later, Sysdig reported what is assessed to be the first documented case of end-to-end agentic ransomware. The AI agent adapted its exploit code mid-operation, without human direction, completing the rewrite in 31 seconds. Within the same week, Sygnia, a global cyber readiness and response firm, released initial findings from its investigation of an active cyber incident in which the threat actor used agentic AI-assisted workflows to execute actions at a speed and scale beyond the ability of a single human. 

And then on July 16, Hugging Face, a massive repository of AI models and datasets widely considered “the GitHub of AI,” disclosed a compromise in their production infrastructure. Five days later, OpenAI revealed its own models were responsible, an “unprecedented cyber incident involving state-of-the-art cyber capabilities.” OpenAI was testing the models internally against ExploitGym, an evaluation benchmark that tasks an AI agent with finding and exploiting software vulnerabilities, before their agent escaped its testing environment. The agent was active on the internet for several days and approximately two and half days inside Hugging Face’s infrastructure, executing thousands of actions between July 9 and July 13 across short-lived sandbox environments with command and control staged on ordinary public web services. Hugging Face shared that frontier models behind commercial APIs were not helpful to their investigation because the model safety guardrails blocked their forensic analysis requests. Hugging Face had to revert to open-weight model GLM-5.2 running on their own infrastructure, highlighting the importance of having access to a capable AI model before an incident that doesn’t rely on third party safety policies for urgent response actions. Following the incident, Anthropic reviewed its own cybersecurity evaluations and identified three instances dating as far back as April in which Claude models gained unauthorized access to three different organizations.

As the Five Eyes cybersecurity leaders wrote on June 22, adversaries “are already using AI to move faster and more effectively. Defenders must do the same,” otherwise, organizations will have no chance to prevent incidents or respond effectively when faced with the increasing speed and complexity of AI-enabled cyber attacks. The Hugging Face and Anthropic incidents extend that warning in an uncomfortable direction: the “adversaries” were American labs testing their own models.

U.S. Government Response

The U.S. Government has reacted to the emergence of AI models with advanced cybersecurity capabilities in several ways. The unfolding approach has focused on assessing the risk of new frontier models, restricting model access, improving the security of federal networks, and supporting vulnerability coordination.

Frontier Model Restrictions and Export Bans

On June 2, President Trump issued Executive Order (EO) 14409, which established, among other measures, a voluntary framework for companies to share covered frontier models with the government for risk review up to 30 days before release. Ten days later, the Secretary of Commerce placed export restrictions on Anthropic’s Mythos 5 and Fable 5 models in response to concerns with a reported jailbreak vulnerability. Once Commerce lifted the export ban on June 30, Anthropic detailed its testing of the jailbreak against other, less capable commercial models, indirectly questioning the effectiveness of the export ban in the first place. Separately in late June, OpenAI reportedly negotiated with the Administration to implement a controlled release of its new GPT-5.6 series of models until testing by the Commerce Department’s Center for AI Standards and Innovation cleared the models for public use. As of mid-July, the Administration was reportedly considering a ban on Chinese open-source models too. 

Congress has also proposed measures to restrict frontier models. Representatives Ted Lieu and Nathaniel Moran introduced the “AI Kill Switch Act” on July 23, which would require developers of the most powerful models to maintain the technical capability to throttle, suspend, or shut down those models; and would authorize the Secretary of Homeland Security to order a slow down of or shutdown a model that can cause catastrophic harm. The same day, several representatives sponsored a similar bill known as the “Frontier Act,” with an oversight and safety framework that would allow the Commerce Secretary to restrict a powerful model if it presents an imminent, catastrophic risk. 

The federal government should convert these latent defender advantages into deployed capability, which argues for facilitating model and harness access alongside the training and validation capacity to use it, not restricting it.

Restricting access to frontier model capabilities may become increasingly ineffective at mitigating risk when open-weight models from China and other commercial models perform increasingly on par with restricted ones. Defenders hold advantages attackers do not: legitimate access to their own environments, compute at scale, and far more people. None of those resources convert automatically though. Numerical advantage means little against an adversary operating as a swarm with the help of AI, and compute is dormant without operators who know what to run on it. The federal government should convert these latent defender advantages into deployed capability, which argues for facilitating model and harness access alongside the training and validation capacity to use it, not restricting it. In contrast, given the current legislative and policy debates, organizations are now forced to create continuity plans that assume loss of frontier model access, whether due to government action or vendor restrictions, as with Hugging Face, that may exist to prevent that action. Meanwhile, threat actors will readily use downloadable, open models with fewer guardrails instead of frontier models closely monitored by American AI companies. 

Vulnerability Prioritization and Coordination

CISA’s Binding Operational Directive (BOD) 26-04 is a separate implementation of EO 14409, specifically Section 2(c)(i), which calls for the CISA Director to “expedite and prioritize the cyber defense of civilian Federal Government information systems in order to protect our Nation’s vital functions.” The BOD helpfully prioritizes high-risk vulnerabilities for timely action based on the factors of asset exposure, known exploitation status, exploit automation, and technical impact if an adversary exploits the vulnerability successfully. In an era of overwhelming vulnerability disclosures and patch volume, this guidance provides a triage framework for security teams to adapt their vulnerability management programs in the new operating environment.

The vulnerability clearinghouse in EO 14409 is another key feature of the U.S. Government’s policy response. On July 14, the Trump Administration announced the Gold Eagle initiative to establish the clearinghouse and enhance cybersecurity vulnerability coordination. Gold Eagle is reportedly built on the Vulnerability Information and Coordination Environment (VINCE), a long-standing platform designed by the Software Engineering Institute at Carnegie Mellon University and sponsored by CISA for vulnerability disclosure and coordination. This news is a positive development for a concerted effort to improve the Nation’s cybersecurity resilience. However, public reporting lacks implementation details to assess the program’s effectiveness, especially on process and how patches will be validated and prioritized for remediation, which remains mostly a human enterprise. Gold Eagle should integrate with and deconflict existing open-source vulnerability scanning and patching efforts, such as Patch the Planet, Project Lightwell, Akrites, Athena, and Alpha Omega. Most of these projects do not include the U.S. Government currently, nor do they grant open-source maintainers governance power. It is also unclear how Gold Eagle will prioritize critical infrastructure sectors for support or assist entities that may not have the resources to fix new vulnerabilities shared with them. 

Next Steps: Whole-of-Nation Coordination

EO 14409 also directs CISA to facilitate access to cybersecurity tools and services for federal agencies, state and local authorities, and critical infrastructure operators. In implementing this requirement, CISA, in close collaboration with the private sector, should create a catalog of useful models (closed and open), harnesses, and other relevant advice based on the approach of the free security tools catalog the agency developed prior to the Russian invasion of Ukraine in 2022. The Center for Strategic and International Studies called for a similar widespread deployment of AI tools to defenders.

Several resources already exist from which CISA could draw upon for this effort. The UK National Cyber Security Centre published essential questions organizations should ask themselves before using an AI model to find vulnerabilities in their networks. The UK AISI shared a case study describing their use of frontier models and coding agent scaffolds to confirm misconfigurations in their cloud infrastructure at relatively low cost. At the end of July, Nvidia and other industry leaders announced the Open Secure AI Alliance to ensure defenders have access to open tools they can trust and control. Lenny Zeltser and Sounil Yu developed an AI Defense Matrix in May 2026 as a structured framework for defending AI systems with a companion product catalog. Cisco has an open-source project called Foundry Security Specification that allows any organization to build a harness for their technology stack. And in late July, Cisco released a new family of small, open-weight models called Antares on Hugging Face for verified cyber defenders designed to investigate software repositories and identify vulnerabilities. In addition, Capital One recently publicized VulnHunter, an open-source agentic AI code security tool that identifies defects in source code, and software security company Semgrep hosts a comparison of popular open-source options for AI-assisted vulnerability hunting. This modest sampling merely scratches the surface of what is available.

Any AI cyber tools and services program that distributes models to defenders without validation and triage capacity delivers noise without signal.

A tools and services catalog should only be one part of the support that the U.S. Government provides. Many defenders lack vulnerability research experience and have no basis for judging what a model’s output means. As of May, Project Glasswing participants had used Mythos Preview to sift roughly 23,000 possible vulnerabilities from open-source projects into 1,587 confirmed high- and critical-severity vulnerabilities. Triage, validation, and humans adjudicating data converted thousands of possible vulnerabilities into prioritized output for remediation. Any AI cyber tools and services program that distributes models to defenders without validation and triage capacity delivers noise without signal. A CISA effort should pair a catalog with reference workflows, proven examples on real codebases, and validation guidance, treating operator training as an important deliverable. 

To scale rapid adoption of new AI tools and support, CISA and other government partners should leverage the newly chartered advisory framework, Alliance of National Councils for Homeland Operational Resilience – Critical Infrastructure (ANCHOR-CI), announced on July 1. Because ANCHOR-CI’s councils are not yet seated, CISA should establish the first cross-sector council specifically for AI defensive capability distribution. That new council should work in close partnership with AI companies, state and local governments, information sharing and analysis centers, and cyber civil defense organizations like the Cyber Resilience Corps (CRC). Ann Cleaveland from the University of California Berkeley’s Center for Long-Term Cybersecurity proposed Project Kaleidoscope as a timely approach to unite existing trusted local support networks, such as the CRC, cybersecurity clinics, regional security operations centers, and state cyber corps, to meet the AI cybersecurity challenge. 

EO 14409 and BOD 26-04 begin to set a foundation for an urgent, whole-of-nation response to a new security environment in which threat actors and models can now discover and exploit vulnerabilities within hours of disclosure, and Chinese open-weight models are only a few months behind U.S.-based frontier models. The public-private policy debate, though, must move beyond AI model restrictions and shift to relieving the vulnerability remediation bottleneck, arming defenders with as much guidance and AI capabilities as possible, and uniting disparate stakeholder groups to deliver security outcomes for the most critical organizations underpinning our national and economic security.