AI and Cybersecurity: Why Open Source Is the Only Way Forward

Mythos is the latest frontier AI model to make headlines, and for good reason: it can rapidly find and patch software vulnerabilities. But if you read the breathless coverage, you’d think the model itself is the story. It’s not. The system around it is what matters—and that distinction has huge implications for how we think about cybersecurity going forward.

The recipe that Mythos demonstrated is straightforward on paper: throw substantial compute at models trained on massive code datasets, wrap them in scaffolding designed for vulnerability probing and patching, add speed from capital, and give the system some autonomy. The result is something that can uncover exploits and build fixes faster than humans alone. But this isn’t magic. Smaller models, embedded in well-designed systems with deep security expertise, can produce similar results at lower cost. That’s good news for defense.

What Mythos actually proves is that the capability is jagged. It doesn’t scale smoothly with model size or benchmark scores. The system architecture—how the model is integrated, what tools it has access to, how its outputs are constrained—matters far more than the model itself. And that’s exactly where openness becomes a structural advantage.

Open Ecosystems vs. Single Points of Failure

Software security has become a speed race across four stages: detection, verification, coordination, and patch propagation. In a closed-source environment, all four stages happen inside a single vendor. That’s a single point of failure. Only one organization can see the code, find the bugs, and push fixes. If that vendor is slow, or misses something, everyone using their software is exposed.

Open ecosystems distribute these stages across a community. The Linux kernel security team, the Open Source Security Foundation, and even Hugging Face’s own model security team are examples of how distributed expertise can move faster than any single organization. When vulnerabilities surface, multiple eyes can verify, coordinate, and patch in parallel. The system is robust to individual failure.

There’s a tired argument that closed code is more secure because attackers can’t see it. That’s called security through obscurity, and it’s been a bad idea for decades. AI systems are now making it worse. Reverse engineering stripped binaries is becoming trivial with AI assistance. Most legacy firmware and embedded code is closed, binary-only, and unmaintained. That’s a massive attack surface, and it’s becoming increasingly legible to anyone with the right tools.

The AI Coding Tool Problem No One Talks About

Here’s something that doesn’t get enough attention: companies adopting AI coding tools under the wrong incentives are actively creating more vulnerabilities. When engineers are evaluated by the volume of features shipped rather than code quality, AI acceleration means more code, faster, with less human review. Those vulnerabilities then sit inside a closed codebase where only one organization can find and fix them. Meanwhile, attackers with AI tools are getting better at finding them from the outside.

The combination of more vulnerabilities produced more quickly, hidden behind a single-organization firewall, is exactly the imbalance that open ecosystems are designed to avoid. Open code means vulnerabilities are visible to defenders and attackers alike, but defenders have the advantage of community, tooling, and the ability to patch proactively.

Semi-Autonomous Agents for Defense

Mythos appears capable of near-full autonomy, which is something I’ve been wary of. Losing control of an AI system that can probe and patch code is a recipe for disaster. The sweet spot is semi-autonomy: prespecified action types, human approval gates for critical steps, and the ability to run everything privately within your own infrastructure.

Open code makes this possible. Organizations can take a model, wrap it in their own security tooling, specify allowable actions and access privileges, and deploy it defensively. The AI handles the grunt work—scanning for vulnerabilities, suggesting patches, running tests—while humans make the final call on what gets deployed. This is the kind of practical, grounded use of AI that actually improves security without introducing unacceptable risk.

The Asymmetry Problem

Underlying all of this is a fundamental asymmetry between attackers and defenders. Attackers only need to find one vulnerability to cause damage. Defenders need to find and fix all of them. Open models and open tooling narrow that gap by giving defenders access to the same class of capabilities that attackers can reach for. Otherwise, those capabilities are concentrated within a handful of well-resourced entities—governments, big tech companies, and the occasional well-funded startup.

That concentration is dangerous. It means the best defensive tools are locked behind paywalls or organizational boundaries, while attackers can use open models to find exploits at scale. Leveling the playing field means making those tools available to everyone who needs them.

Where We Go From Here

Mythos isn’t the end of anything. It’s a signal that the era of AI-assisted cybersecurity is here, and it’s moving fast. The question isn’t whether these systems will be built—they will be. The question is whether they’ll be built in the open, with community oversight and distributed responsibility, or behind closed doors where a single failure can cascade into a global problem.

I know which side I’m on. Open source has a track record of producing more secure software, faster, and with fewer single points of failure. AI doesn’t change that calculus. If anything, it makes openness more important than ever.