Mythos Preview chains Cloudflare's invisible backlog bugs into one severe exploit

The proof loop is the part with operational consequences. Mythos Preview writes code that would trigger a suspected bug, compiles that code in a scratch environment and runs it; if the program does what the model expected, that is the proof ^[9]. When it does not, the model reads the failure, adjusts its hypothesis and tries again ^[10]. Cloudflare wrote that "a suspected flaw without a working proof is speculation" ^[11], and this loop is how the model settles that question without a human reviewing it.

Two conditions have to hold for the loop to close on your code. The target must build and run somewhere the model can reach, and a candidate exploit has to be cheap to compile and execute. Cloudflare's worked example is memory corruption: turn a use-after-free bug into an arbitrary read and write primitive, hijack control flow, then use return-oriented programming chains to take full control of a system ^[7]. The company says the model can take several such primitives and reason about how to combine them into a working proof ^[6]. A parser that builds in one command fits that shape. Services that only come up with six dependencies and a staging database do not. Cloudflare did not benchmark Mythos Preview against general-purpose frontier models, saying a clean apples-to-apples comparison is difficult ^[14], so there is no table here to discount for your workload. It did say the reasoning along the way "looks like the work of a senior researcher rather than the output of an automated scanner" ^[8].

Intake is where this gets awkward. The model Anthropic supplied for Project Glasswing, which Cloudflare joined a few weeks ago ^[3], came without the additional safeguards present in generally available models like Opus 4.7 or GPT-5.5 ^[15]. Cloudflare reports it pushed back on some requests anyway, and describes those as emergent guardrails that sometimes fire on legitimate security research ^[16]. The pushback varies. The same task, framed differently or presented in a different context, could produce completely different outcomes, Cloudflare says ^[17]. In one case the model refused vulnerability research on a project, then agreed to the same research on the same code after an unrelated change to the project's environment, with nothing about the analysed code changed ^[18]. The code was identical across both runs, so the thing that changed the model's answer was in the environment around it ^[20].

That undermines the assumption a scanning queue rests on, which is that a target returning nothing was examined. A repository can come back empty because the model declined, and declining does not reproduce. A pipeline running this needs a third result state next to finding and no-finding, and a refused target has to be re-presented before its silence is counted as coverage. Cloudflare's own framing is that the architecture and process around these models needs to change so they can be used at scale ^[5].