Google reports high confidence that a criminal threat actor used an AI model to discover and weaponize a significant software vulnerability.
Key Takeaways
Google’s attribution explicitly links AI-assisted vulnerability discovery to a real-world criminal exploit, a first in public reporting.
Anthropic’s Mythos model, announced recently, is considered capable enough at finding security flaws that distribution was restricted to select US and UK firms and agencies.
OpenAI’s equivalent restricted offering is GPT-5.5-Cyber, a permissive variant of GPT-5.5 with safeguards removed for security research, per OpenAI.
The pattern mirrors the fuzzing era: AI lowers the bar for finding novel bugs, potentially devaluing existing zero-day stockpiles held by nation-states and brokers.
Hacker News Comment Review
Core skepticism centers on Google’s attribution method: commenters note that unless the attacker used a provider like Google or OpenAI, transcript-based evidence is speculative, though Google’s internet-scale visibility could support indirect inference.
The article’s technical credibility took hits for conflating Mythos and GPT-5.5 as equivalents; the restricted “cyber” tier of each model is the relevant comparison, and they differ meaningfully.
Several commenters see security framing as a policy lever to restrict open-weight models, drawing parallels to historical crackdowns on cypherpunk tools, though others argue neither the US nor China can afford unilateral R&D lockdowns.
Notable Comments
@gman2093: Attackers only need to succeed once, so LLM error rates matter less offensively than defensively, potentially devaluing zero-day hoards.
@cobolcomesback: Clarifies GPT-5.5-Cyber is the Mythos analog, with safeguards removed for security work, separately gated from standard GPT-5.5.
