Why Anthropic and everyone else 'scared' of the company's latest AI model Mythos are 'wrong,' says one of the world's biggest hackers

Anthropic's Mythos model drew pushback after claims it found a 27-year-old OpenBSD bug and chained FreeBSD exploits for root access, but critics argued the demo was overstated and lab conditions were unrealistic. George Hotz said zero-days are cheaper and faster to find than Mythos suggests, while AI researcher Gary Marcus and Yann LeCun dismissed the announcement as overblown. The article also notes that small open-weights models reproduced key vulnerability detection results at far lower cost, tempering the perceived breakthrough.

Analysis

The market is conflating model capability with monetizable security alpha. The more important takeaway is that AI has likely commoditized the first 80% of vulnerability triage, which compresses the value of mid-tier offensive security tooling and shifts spend toward last-mile exploitation, endpoint hardening, and workflow integration. That is bearish for vendors whose pitch is “better detection through bigger models,” but supportive for incumbent security platforms that own telemetry, distribution, and compliance budgets.

For the named equities, the direct read-through is asymmetric. META is largely insulated: if anything, stronger open/closed-model competition lowers the odds that frontier AI remains a durable moat, while leaving META’s ad and infra economics intact. SONY gets the only small negative through the PlayStation security lens: proof that advanced AI can accelerate exploit discovery modestly increases the probability of future console jailbreak cycles, but this is a long-duration, non-linear risk rather than an imminent earnings issue.

The contrarian miss is that the headline debate is probably less about actual zero-day volume and more about procurement psychology. If enterprise buyers conclude that AI can replicate enough exploit discovery to matter, security budgets may rotate away from point tools toward platform consolidation over the next 2-4 quarters. That would pressure smaller cybersecurity names first, not because the models are magic, but because CIOs tend to buy fear narratives before the market validates them. The reversal catalyst is another public demo showing autonomous end-to-end exploitation on a live, patched target without lab conditions; absent that, the overhang fades quickly.

Key Decisions for Investors

• Short basket of smaller cybersecurity point-solution names versus long MSFT/CYBR/CRWD into the next 1-2 quarters; thesis is budget consolidation, not sector collapse. Risk/reward is attractive because sentiment can re-rate lower even if fundamentals stay intact.
• Avoid chasing any long in AI-security pure plays on the demo alone; wait for evidence of enterprise budget capture over 2-3 earnings cycles. If revenue acceleration does not materialize by then, multiple compression is likely.
• For META, use weakness tied to broader AI-capex skepticism to add selectively on a 6-12 month horizon; the article does not impair ad monetization or infra roadmap, and the market may over-assign model politics to the stock.
• For SONY, treat cybersecurity narrative as a low-probability tail risk, not a thesis changer. Only consider hedging with short-dated downside if there is an actual jailbreak/exploit cycle catalyst; otherwise the premium decays faster than the risk manifests.
• Watch for a follow-through selloff in cybersecurity vendors over the next 5-10 trading days; if the move is broad and indiscriminate, fade the weakest balance sheets first and cover into the first sign of enterprise spending commentary stabilizing.