Skip to content

Mythos and Fable hype - should I be worried?

Since Fable 5 and Mythos 5 landed back in June, I keep seeing the same reaction online - "AI can now hack anything, we're doomed." I've been mulling this over, mostly in the context of a self-hosted, encrypted project I'm tinkering with, and I don't think the panic is pointed at the right thing.

It's not a new kind of risk, it's a shift in an old one

I keep coming back to the same formula - Risk = Likelihood x Impact. If you run that over most systems, including the bespoke stuff nobody but you has ever looked at, here's what I find:

Impact hasn't changed. An auth bypass is an auth bypass, whether a human found it after two weeks of poking around, or an agent found it in an afternoon. The damage on the other end is identical.

Controls haven't changed either, and they still work. Proper auth, input validation, least privilege, parameterised queries, audited crypto libraries - none of that becomes weaker because the attacker is an AI instead of a person. If your defences were solid before, they're still solid.

Likelihood is the one that moved. And this is the bit people gloss over. For a random bespoke app that nobody's ever properly audited, the old assumption baked into "likelihood of this bug being found" was really "will a sufficiently determined human ever bother looking at my niche little app." Obscurity was quietly doing a lot of that work, even though nobody wanted to admit it. Agentic tools like Mythos - recon, lateral movement, exploit chaining, all automated - collapse that cost. Obscurity stops being a meaningful likelihood-suppressor.

"Metasploit on steroids" - is that fair?

Sort of, but it undersells it. Metasploit is a library of known exploits for known vulnerabilities - point it at code nobody's ever seen a CVE for, and it does nothing. Agentic AI is a different beast - it can go looking for novel vulnerabilities in code nobody's ever audited, at a speed that used to require a genuinely skilled researcher spending days or weeks. Now it's plausibly hours.

A few things worth remembering

Crypto like AES-256 is not the attack surface here. No AI makes brute-forcing a properly implemented cipher any more feasible - the maths simply doesn't budge. The actual attack surface was always sitting around the crypto - the auth flow, session handling, how sharing and revocation get implemented, the API surface. That was true before Mythos existed, and it's still true now.

If your implementation was never audited, it was already a "fails open" risk. AI doesn't invent that risk - it just makes it much cheaper to find. And that "ship the MVP now, harden it later" gap a lot of us lean on? It was always partly propped up by nobody having the time or motivation to go looking. That prop is getting thinner.

The bit that gets overlooked

Here's something I don't see people talking about enough - Frontier AI has quietly accelerated vulnerability detection on the vendor side too. Cisco, Palo Alto, and the rest of that crowd are using these same tools to find CVEs in their own products, faster than they used to. That's a good thing.

What I'm not seeing - yet - is anyone actually using Frontier models to attack companies at scale. Doesn't mean it can't happen, it absolutely could. But right now the tooling seems to be doing more for the defenders finding bugs in shipped products than it is for attackers going after them.

Which is exactly why this is the moment to tighten your patching and identity game, not loosen it. If a vendor CVE drops faster than it used to, and the attacker side does eventually catch up, the gap between disclosure and someone weaponising it is only going to shrink.

What I'm actually taking away from this

If anything, nothing has really changed. Keep patching. Keep MFA in place. I'm not redesigning any controls over this, and I'm definitely not losing sleep over the crypto. What I am doing is recalibrating how I score likelihood for anything unaudited or under-reviewed, and letting that push hardening work further up the priority list - not expanding the scope of the hardening itself, just moving up when it happens.

For context - Fable 5 is the public model (cyber/bio/distillation classifiers fall back to Opus 4.8 when tripped), and Mythos 5 is the same model with the safeguards lifted, restricted to Project Glasswing and vetted defenders. Both launched around 9 June 2026.

So - should I be worried? Not about the crypto, and not about my controls. Just about how long "nobody's looked at this yet" is going to keep buying me time.

Free Resources