Reassessing the Cyber Risks of Open AI Models

Last week, the term “Black October” was coined to describe an onslaught of critical vulnerability disclosures, including PHP2Shell and GitLab. These events appeared to mark the point at which the cyber risks of AI models began to materialize. The news cycle seemed to stabilize briefly, but another major crypto security incident at Binance followed. The crypto industry has a long history of hacks, so it is not necessarily the best indicator of vulnerabilities translating into new forms of societal harm. Even so, the broader implications are still unfolding.

The most plausible explanation for what is happening in cybersecurity is that behind-the-scenes response efforts have accelerated. More people and resources are being deployed to patch vulnerable internet systems. The Wall Street Journal reported that cyber first responders are under strain, which suggests that the response system is active. At the same time, vulnerability disclosures appear to be following an exponential growth curve that may take a long time to level off.

A few weeks ago, before the rapid increase in vulnerability disclosures and reported hacks, the argument was made that concerns about open-weight AI models had been overstated. The discussion that followed included both dismissive criticism and substantive feedback, prompting a closer examination of that position.

Would an open-weight release of Claude Mythos have been manageable?

When Claude Mythos was announced, it was presented as a possible new class of cyber weapon. The concern was that if the model reached criminals or hostile state actors, it could cause widespread social disruption.

That assessment may have been wrong.

By the available measures, GLM-5.3 is the model that crosses the relevant capability threshold. Yet there is little public evidence that the situation has changed dramatically, even more than a month after the model weights were released.

If Claude Mythos had accidentally been released as an open-weight model, the world might have remained broadly functional. Cybersecurity incidents would likely have increased, and the consequences would have been harmful, but the result might have looked more like an acceleration of existing risks than a sudden change in their nature.

Some prominent advocates of stronger restrictions on open-weight models effectively made a falsifiable prediction: that current open-weight systems would cause substantial, unprecedented harm by crippling cyber infrastructure.

Based on the available evidence, that prediction appears likely to be wrong. After years of debate about open-weight risks, real-world events are beginning to provide more concrete answers.

How the risks were described

To assess this position fairly, it is useful to examine how the AI safety community discussed the possibility that Claude Mythos could become open-weight. The impression was that many statements presented such a release as a potential disaster rather than as a serious but manageable escalation. Whether or not “true disaster” was the precise wording used, public interpretations are shaped by how people hear and internalize these warnings.

Examples of language that appeared particularly strong included:

• Rob Wiblin, host of the 80,000 Hours podcast, said on April 10, 2026: “If it fell into the hands of criminals or hostile state cyber actors, it would be an actual disaster.”
• Anthropic wrote in its Project Glasswing announcement on April 7, 2026: “Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely. The fallout, for economies, public safety, and national security, could be severe.”

A more measured example came from Zvi Mowshowitz on April 9, 2026: “Claude Mythos would give attackers a cornucopia of zero-day exploits for essentially all the software on Earth ... It would be chaos.” So far, that chaos has largely been concentrated among organizations operating large-scale digital products, although the situation could change.

The original argument still appears broadly correct, but there is reason for caution. Cybersecurity expertise is limited, and predicting how these systems will affect attacks involves considerable uncertainty. The distinction between “technology companies must work much harder to remain secure” and “public infrastructure is failing” is significant.

It is clear that more critical vulnerabilities are being discovered in widely used tools, and that fixes are being developed in response.

Finding vulnerabilities is only one step

Epoch AI recently described internal work using GLM-5.3 to identify vulnerabilities and combine them into potential attack chains. The exploit found in Firefox illustrates why cyber harm usually requires several conditions to align:

We used GLM 5.3 to create a website that, simply when visited by a Firefox user and without further interaction, gave the attacker the ability to exfiltrate files from the user’s computer.

In this case, the vulnerability was in Firefox, and an attacker would need to place a website where victims would visit it. That is feasible and could have serious consequences, but discovering the vulnerability represents only one stage in a multistep attack process.

The earlier argument should therefore have been more precise about what “fine” means for the future of cybersecurity. The AI safety community deserves credit for identifying this as the beginning of a new period of cyber instability. The transition will likely force industries to change how they develop and maintain software, creating significant costs and requiring sustained effort.

For people already expecting serious disruption from AI, “fine” may describe a difficult but manageable future. For those who have not anticipated a turbulent transition, the word understates the challenge. The more realistic expectation is that difficulties will arrive, while people and organizations continue to address immediate problems through patches and operational changes.

Open models and the offense-defense balance

The central position was that open models may provide some balance between cyber offense and defense, and that an earlier release of Claude Mythos would not necessarily have radically changed that balance.

Large companies may adopt open-weight models more quickly than attackers because most attackers have fewer resources than the organizations they target. An important variable is how willing attackers are to cause physical harm within the United States and its allies. Adversaries may already be using models and exploits to extract information at scale and in secret, but it remains unclear whether an actor will direct the full capabilities of these systems against public institutions to cause mass harm.

Threat actors also operate according to established incentives and processes. As one observation put it, it is easier to understand them as businesses with defined operations than as hackers who will attempt to break into systems by any available method.

A bakery would not begin producing dog food simply because a dog food shortage emerged. Similarly, ClickFix and phishing operators are unlikely to abandon their existing activities to build exploits merely because a critical CVE has been disclosed. The fact that the actors exploiting these vulnerabilities are generally those whose established methods already involve exploitation is predictable when threat actor behavior is considered.

Open and closed models in practice

Most of the vulnerabilities being discovered may currently be found by closed models, although confidence in that prediction is limited. Much depends on how open models are used in the near term.

Open models remain expensive to serve, and the computing capacity required to operate the largest systems is highly constrained. If open models are used in a near-term attack, the model may be accessed through an inadequately secured open-model API. Over the longer term, prices and operating margins for open models are likely to fall as computing capacity becomes more abundant. In the short term, however, closed models are generally more cost-effective.

This creates a structural concern: a small number of companies may be developing tools that produce large amounts of software, including vulnerable software, while also selling tools intended to identify and repair those vulnerabilities.

For now, the industry is working through a backlog of cyber vulnerabilities while moving from an internet centered on direct human activity toward more closed systems in which activity is mediated by software agents.

A broader cybersecurity trend

The current situation appears to be driven more by the general capabilities and spread of AI than by the distinction between open and closed models. Cybersecurity researchers often focus on the wider ecosystem, noting that exploit rates and overall cyber damage had been increasing since long before ChatGPT. Recent events may therefore be part of an existing trend whose growth has become exponential.

Ecosystem-level measurements will help determine whether AI capabilities and availability are the primary bottlenecks on cyberattacks. If they are, the data should show a clear step change rather than only a continuation of the previous trend.

Closed models have played a significant role in recent hacks, apparently more than open models have. This suggests that cybersecurity is a societal problem that AI companies cannot solve alone. Addressing it will require attention at the broader ecosystem level, rather than relying solely on the technology industry centered in San Francisco.

The current period is likely the first of many transitions that society will need to manage as AI capabilities continue to spread.