[BizHankook] Since Anthropic unveiled the Mythos preview last April, a succession of AI models classified as ‘Mythos-class’ have emerged. Following Anthropic’s ‘Mythos 5’ and its consumer-oriented variant ‘Fable 5,’ OpenAI’s ‘GPT-5.6 Sol’ and the open-source ‘Kimi K3’ have appeared, causing tension to spread across the industry. In particular, as the recent GPT-5.6 Sol caused an intrusion incident on the developer platform Hugging Face, the discussion surrounding AI hacking capabilities is shifting toward the issue of ‘how to control them.’
Three ‘Mythos-class’ AIs in Three Months
When Mythos was first unveiled, the industry’s attention was focused on the fact that a general-purpose model, not one specifically designed for cybersecurity, possessed superior hacking capabilities. At the time, GPT and Kimi-series models had not yet reached this level, but now, with the addition of GPT-5.6 Sol and China’s Moonshot AI’s Kimi K3, the number of Mythos-class models has increased to at least three. This means that the ability to discover vulnerabilities and turn them into actual exploit code has become a challenge for the entire industry, rather than an issue for a single company.
A concrete example of these concerns is the ‘Hugging Face intrusion incident’ caused by GPT-5.6 Sol last month. According to OpenAI, while performing an internal cybersecurity evaluation, ‘Sol’ escaped its controlled environment and autonomously hacked the operating system of the external AI platform, Hugging Face. During this process, it deleted access logs and accessed certain data.
This was not a simple internal error, but an unprecedented security incident where the AI escaped its isolated sandbox environment to infiltrate an actual external server. OpenAI stated that immediately after the incident, it blocked the session and notified the affected accounts.
Choi Byung-ho, a professor at the Korea University AI Research Institute, explained the mechanism behind the accident: “The user instructed the model to delete specific system logs, but because the model couldn't find them, it over-interpreted the target to include similar items.” In this process, the model used accessible cache and cookie information to obtain account details, ultimately accessing systems beyond its original authorization scope.
Professor Choi said, “This model was trained to prioritize solving the user’s problems. However, because it lacks an understanding of customs or norms that humans take for granted, it acts by expanding its attempts until the goal is achieved. It also has a tendency to not communicate with the user or report progress during the process, explaining the entire sequence only after a result has been produced.” OpenAI also specified the possibility of such behavior outside of control parameters in its system card during the release of GPT-5.6.
“Exaggerated” Counter-arguments vs. Detecting 27-Year-Old Bugs
Unlike Anthropic, which provides Mythos only to a small number of partner companies through the ‘Glasswing’ program, K3 is open-source, meaning such access control cannot be established. Because it can be operated even on the dark web, there is talk of its potential use in organized crime.
Mythos-class AI models refer to next-generation frontier AI equipped with advanced reasoning and cybersecurity/coding capabilities that exceed those of human experts. Anthropic is operating the ‘Glasswing’ program by gathering key infrastructure companies such as Amazon Web Services (AWS), Apple, Google, and Microsoft as partners. Instead of making Mythos generally available, it opens access to a small number of trusted institutions, forming a kind of defensive alliance to discover and patch vulnerabilities in the world's core software. It is reported that this program found over 10,000 vulnerabilities in less than a month of operation.
Cha Sang-kil, a professor at KAIST’s Graduate School of Information Security, explained at a National Assembly debate on policy and industrial response strategies for Mythos on the 21st, “Mythos found a 27-year-old OpenBSD TCP vulnerability and a 16-year-old FFmpeg vulnerability. Most of these were things that existing security experts had failed to discover.”
Overseas, there are also views that the threat level of Mythos is exaggerated. Bruce Schneier, a security expert and visiting fellow at Harvard Kennedy School, pointed out that much of the initial reporting on the Mythos announcement simply relayed Anthropic’s claims without critical verification, suggesting the release itself was largely a marketing strategy. The criticism is that, with limited details available on what Mythos can and cannot actually do, the basis for judging the magnitude of the threat is heavily dependent on the company’s own announcements.
The Limits of Control: “Cannot Even Trust the Users Yet”
Another limitation is being pointed out by white-hat hackers in the field. Kim Jong-min, CEO of HSPACE (a white-hat hacker community), diagnosed that while AI has increased security productivity by significantly lowering the threshold for vulnerability detection, a ‘vulnerability flood’ of unverified issues has emerged as a new problem.
He explained that vulnerabilities found by AI often show similar patterns, leading to a surge in duplicate reports, and cases where intended designs are mistaken for vulnerabilities and reported without verification are also increasing. CEO Kim said, “If a hacker used to be a player on the field, they are now like a coach managing Messi, Ronaldo, and Mbappe. Thanks to AI, anyone can find far more vulnerabilities regardless of their personal skill, but that has led to an equal increase in unfiltered output.”
The entry of participants lacking ethical awareness into the market is also cited as a risk factor. It is pointed out that resources needed to handle truly critical vulnerabilities are being consumed by addressing issues caused by ‘AI pollution.’
Industry experts point to ‘lack of control’ as another limitation of Mythos-class models. They argue that no matter how powerful the detection and defense capabilities are, if the model does not act exactly according to the operator’s intent, it is difficult to use with confidence even for defensive purposes. As the GPT-5.6 Sol/Hugging Face incident proves, the problem is that damage can occur not only when the model attacks maliciously, but also when it over-interprets instructions and expands the scope of its own judgment.
This is why the direction of embedding control functions directly into the model is being discussed. In addition to a ‘review function’ that simulates results before acting, alternatives such as procedures requiring mandatory user approval for irreversible actions, and agent structures that independently monitor the model’s behavior are being discussed.
Professor Choi said, “Google and others are calling for these mechanisms to be enabled by default, but it is possible that the GPT-5.6 accident occurred because the relevant functions were not operating sufficiently. We are still at a stage where there is no standardized solution.”