Claude Mythos represents an important step forward in cybersecurity. Through our partnership with Anthropic, ReliaQuest is among the few to have access to Mythos, actively deploying its advanced reasoning capabilities for defensive testing.
We are putting this technology to work to explore where frontier AI can sharpen defenders’ speed and accuracy against AI-accelerated threats. Here are 10 ways we are testing Mythos to improve defense and the findings we are seeing from that work:
Mapping attack surfaces.
In testing, Mythos uncovered a non-obvious cloud attack path by flagging an obscure API function with hidden access implications.
This finding helps surface hidden exposure that typically requires deep cloud, code, and attacker expertise.
Building offensive tools for authorized testing.
Mythos is also being used in internal controls to develop advanced adversary scenarios and more complex malware variants for defensive testing.
Where other models require heavy human guidance, Mythos can reason through deeper system-level complexity and accelerate this research at scale—giving our team a deeper view into how sophisticated tools behave.
Developing and validating exploit paths.
We found that Mythos excels at rapidly converting exploit theory into functional code, a task where most models struggle.
During a complex PHP2Shell rebuild involving four bugs across two CVEs, Sonnet merely replicated the behavior, while Mythos successfully generated a fully weaponized, actionable Proof of Concept (PoC) in just one day.
Predicting attacker behavior.
In testing across a 41-stage synthetic macOS infostealer attack chain, Mythos 5.1 led the other models in predicting the attacker’s likely next move. Mythos 5.1 achieved the top first-guess accuracy at 39%, followed by Opus 5.5 (34%), Haiku 4.5 (15%), and Sonnet 4.6 (12%).
When evaluating the accuracy of the top three predictions, Opus 5.5 identified the next activity 61% of the time and Mythos 5.1 56%, compared to Haiku 4.5 (54%) and Sonnet 4.6 (27%). Scored by how high the next activity ranked, Mythos 5.1 (0.47) and Opus 5.5 (0.45) were nearly tied, showing how advanced reasoning can help anticipate what attackers may do next.
Researching malware behavior and new attack techniques.
Mythos helps document how attackers reason through each step of an attack. In testing, this has helped our teams more accurately replicate attacker behavior in adversary scenarios and understand how sophisticated tradecraft unfolds in practice.
Those insights are then fed back into defensive operations, helping teams strengthen detections, improve response logic, and validate where controls can disrupt attacker behavior across the environment.
Safely scaling defensive testing.
As frontier models like Mythos lower the skill barrier for launching advanced techniques, our internal attack harness gives our teams a controlled way to safely and repeatedly test similar activity in our own environment.
This helps us find and close coverage gaps long before they create risk.
Adversarially reviewing planned attacks.
In one test, Mythos evaluated part of our existing detection library and identified where controls missed earlier signals in a multi-stage attack chain. Instead of reviewing rules in isolation, Mythos analyzed how detections worked together and where gaps existed between them.
Mythos completed this analysis in 1.5 hours, compared to 4.5 hours for a baseline frontier model. It required roughly 50% fewer interaction turns to produce actionable findings.
Assessing whether controls blocked identified paths.
Security controls are only valuable if they stop the path they are meant to stop.
Mythos is helping us assess whether WAF, Cloud Armor, service-mesh, and other controls actually block identified attack paths. This shifts the internal benchmark from a compliance question such as “Do we have the control?” to an active validation, such as “Does the control stop this attack path?”
Investigating credential exposure and boundary risk.
Credential exposure remains one of the fastest ways attackers gain access, while misconfigurations frequently create unexpected entry points. The challenge is knowing which exposures are the most actionable to an attacker.
We have seen Mythos apply attacker-style reasoning across large volumes of exposure, vulnerability, and configuration data to identify which risks are most likely to be used in a real attack path. That helps teams prioritize the exposures that matter most, map where access and misconfiguration could cross boundaries, and connect each issue to potential impact.
Turning findings into prioritized fixes.
Finding risks is not enough. Teams need to know what matters first, how to resolve it, and how to permanently close the loop.
We are seeing Mythos turn technical findings into impact assessments, prioritized fixes, and automated remediation checks—accelerating the loop from finding to fix.
What’s Next?
Frontier models are steadily advancing. ReliaQuest is researching how to harness that progress for defenders, turning new AI capabilities into measurable defensive outcomes that help teams find risk faster, validate controls, and reduce the time between finding a vulnerability and neutralizing a threat.
Security teams can use these findings to prepare for advanced AI in security operations by focusing on four actions:
Test defensive readiness: Validate whether existing controls can stop critical attack paths.
Audit telemetry: Confirm that you are collecting the data needed for AI-driven detection.
Map attack paths: Identify the exposure points attackers are most likely to use.
Modernize response: Move from isolated incident handling to automated threat response.
With the right foundation, defenders can turn each new AI advancement into stronger, faster defense— and stay ready for what’s next.
