Can Open-Weight Models Run Mythos-Class Cyberattacks?

Can open-weight models run the same attacks as restricted frontier cyber models?

According to one widely shared commentary, yes. The claim is that downloadable models such as GLM 5.3 and MiniMax M3.1 Flash can now run the same suite of attacks that Anthropic's Mythos Preview and OpenAI's GPT-6 Astra were held back to defend against, roughly six months after Project Glasswing and Patch the Planet launched. No benchmark or primary evidence came with that claim, so treat it as plausible but unverified. The surrounding incidents are real enough to take seriously.

What were Project Glasswing and Patch the Planet?

Both are efforts by frontier labs to use their strongest cyber-capable models defensively before attackers could. Anthropic's Project Glasswing gave Mythos access to a limited set of trusted partners rather than releasing it broadly. OpenAI's Patch the Planet is the analogous initiative, aimed at finding and fixing as many critical vulnerabilities as possible before malicious actors could.

The premise was a head start. If a model can find serious bugs faster than humans, the labs could use that lead to patch widely used software first. Some observers said this was a marketing stunt. Others, including the commentators behind the sources here, argued the capability was real and people should harden their systems.

Not everyone liked the arrangement. Keeping the best models in reserve for security work frustrated people who wanted broad access. The six-month question is whether the reserve mattered once comparable capability showed up in downloadable weights.

What actually happened with PHP?

PHP underlies an estimated 70% of websites, WordPress included. The NSA's cyber account advised organizations using PHP to prepare for an update addressing two critical vulnerabilities, noting that bugs of this kind often give a direct path to the server's file system or database. Its guidance: if an immediate update is not feasible, take the system offline until it is fully mitigated. Japan's prime minister issued a similar urgent request, and one commentator claimed the entire Dutch government had shut down, then said he was slightly exaggerating and that they had shut down a lot of their services.

OpenAI said an internal cybersecurity model helped find the bug and called it one of the most impactful vulnerabilities in recent memory. The security firm behind the write-up (named in the transcript as Kalif.io) joined Patch the Planet and used OpenAI and Gemini models. Their work centered on how PHP behaves when it runs out of memory and has to clean up mid-operation. They found interruption points that let them chain a remote code execution against WordPress, meaning an attacker could run code without logging in.

Two details are worth flagging as unconfirmed. One commentator said Cloudflare was already seeing early attacks. Another said the details may have leaked online before the patch landed, but he could not verify it and noted events were unfolding live.

How did researchers get a model to keep finding bugs?

The notable technique is the loop. After the first successful chain, a researcher asked ChatGPT to generalize what they had done into a skill file, a set of reusable instructions for hunting similar flaws. Each new finding improved the skill, and the model then used the improved skill to search more paths than a human could.

This is the same pattern as self-improving agent loops: try something, keep what works, discard what doesn't. Nothing about it needs a restricted model. It needs a capable one, a way to test hypotheses, and patience. That is why the open-weight claim matters. If the bottleneck is competent iteration rather than secret access, the gap between gated and downloadable models narrows quickly.

What do the reported leaks and bank attacks tell us?

The sources describe several incidents, all of them reported rather than independently confirmed here:

The key claims are secondhand and some are stated by commentators as hearsay. The pattern still holds together. Attackers are automating reconnaissance and exploitation across many targets at once, and they are finding the oldest kind of failure, bad key hygiene, as readily as exotic memory bugs. Notably, the bank attack reportedly used commercial models, which suggests the open-weight question is about scale and cost as much as capability.

Who is safest, and who is exposed?

The uncomfortable point from the commentary is an inner-circle advantage. Governments and companies inside Glasswing or the OpenAI equivalent get early access to defensive models and early warning on patches. Large tech companies have staff awake when an emergency update ships.

The exposed group is the middle: organizations large enough to hold valuable data but too small to have dedicated security teams. The sources point to Korean and South American banks and smaller European banks as likelier victims than large American ones. Add unmaintained WordPress and PHP sites, where no one is watching for the update, and a large part of the web is effectively on a delay timer.

What will the next six months look like?

The following is inference from the reporting, not a prediction anyone can prove.

• More ransomware. If attackers can cheaply find and chain bugs, locking systems and demanding payment is the obvious monetization. The commentary expects it across major institutions.
• Faster exploitation after disclosure. The gap between a patch announcement and mass exploitation shrinks when models can read a diff and write an exploit.
• Uneven damage. Open models do not need to match the frontier everywhere. Matching it on a handful of attack types is enough to cause widespread trouble.
• Pressure on software choices. Businesses will reconsider how much they expose through dashboards, APIs, logins and stored customer records.

How should individuals and businesses respond?

For individuals, the advice in the sources is consistent:

1. Delete accounts you do not need, especially those that collect the same personal details repeatedly. Fewer places holding your data means fewer places to be breached.
2. Replace SMS verification with a hardware security key or an authenticator app.
3. Use a unique password for every account.
4. Agree on a verbal code phrase with family so a cloned voice or convincing message can be checked.
5. Be careful with links in texts and email during active disclosure periods.

For businesses:

1. Cut the number of sites and stacks you run.
2. Question whether you need public APIs, user logins or stored credentials at all. Delegating sign-in to a large identity provider through OAuth means you hold less liability.
3. Patch, then get confirmation that the fix is actually running.
4. For high-ticket sales, add an in-person or otherwise hard-to-fake verification step.