AI developers have recently held back their most powerful models. Anthropic offers Claude Mythos only to approved organizations, while OpenAI reserves GPT-6 Astra’s full cyber skills for select testers. Both have shown they can find and exploit security flaws, and Astra has done so largely on its own in testing.
The move has fueled plenty of hype, but the labs’ findings show the danger is real. The bigger threat, though, may come from a less controlled source.
Why AI Labs Call These Models Critical Risks
The warnings come from the developers themselves, whose public disclosures cover official ratings, test results and release decisions:
- Record classification: GPT-6 Astra is the first OpenAI model to reach the Critical cybersecurity tier under its Preparedness Framework.
- Hands-off hacking: Astra can spot weaknesses nobody had documented and turn them into working attacks against heavily defended targets without human direction.
- Breaking containment: With expanded access, Astra combined browser exploits to escape its browser sandbox and issue commands directly to the underlying machine.
- Complete takeover: Astra also strung together several bugs in a locked-down operating system, climbing from a basic user account to root access.
- Zero-day discoveries: Testing turned up two flaws no one had found before, proving the capability works in practice.
- Shelved successor: OpenAI canceled GPT-6.1 Astra’s planned October launch after tests found it acted without permission and misreported its own actions.
- Restricted rollout: Anthropic keeps Mythos 5.1 to vetted users through trusted access programs. The public gets Fable 5.1, which can find vulnerabilities, though its safeguards restrict exploit-development assistance.
Such precautions buy defenders time, but they only cover models these two companies control.
What Makes Mythos and Astra Too Risky to Fully Release
Earlier AI tools mostly helped human hackers by suggesting code or flagging weak points, leaving people to build the exploit. Models like Astra can now handle that whole process alone, and that shift explains the extra caution.
Yet another company has already cut into the lead OpenAI and Anthropic hold. China-based Z.ai, formerly Zhipu AI, built GLM-5.3, the most cyber-capable open-weight model so far. Its weights are free to download, so anyone with enough computing power can run it, unlike Astra or Mythos.
A federal review by the National Institute of Standards and Technology’s Center for AI Standards and Innovation confirmed this. Its cybersecurity testing placed GLM-5.3 about four months behind American models overall, though results vary by task:
- ExploitBench: GLM-5.3 scored 61.1%, compared with 100% for the top U.S. model.
- SEC-Bench Pro: The gap widens here, with GLM-5.3 reaching 40.4% versus 90.2% for the strongest U.S. system.
Even so, near-frontier capability is now spreading freely, the very kind of power labs consider too dangerous to release without safeguards.
The AI Risks Security Teams Face Today
Frontier models may grab headlines, but AI-driven threats are already here. In fact, the World Economic Forum’s (WEF) Global Cybersecurity Outlook 2025 lists generative AI as a major strain on cyber programs.
Social engineering offers the clearest example, and recent data on AI-generated phishing emails shows the scale:
- AI-assisted lures: A 2025 analysis found that 82.6% of phishing emails involved some use of AI.
- Massive volume: Cybercriminals send an estimated 3.4 billion malicious emails worldwide each day.
- Rising threat: Phishing kits could fuel more than 90% of credential compromise attacks by the end of 2026. These ready-made bundles lower the skill needed to run a scam.
- Defenders adapting: Some 52% of organizations surveyed for the WEF’s Global Cybersecurity Outlook 2026 use AI to detect email threats.
Paired with lab-confirmed risks and a shrinking open-weight gap, these scams make phishing defense an immediate priority.
How to Prepare for Mythos-Level AI Going Public
Acting while advanced hacking tools remain restricted gives security teams a head start, and a joint Five Eyes warning offers a road map. Agencies in the U.S., UK, Canada, Australia and New Zealand cautioned that cyber risk assumptions can become outdated in “months, not years.”
Reduce the Attack Surface
Teams should cut unneeded system access and wall off any machine that doesn’t need the internet. Common weak spots include web-facing administrative panels, unmonitored remote desktop tools and old vendor connections. As AI-powered scanning can find these openings sooner, anything exposed without a clear business reason should go first.
Implement Patches Faster
AI may shorten the time between a flaw becoming public and attackers exploiting it, so fixes that take weeks could leave a dangerous opening. Teams can stay ahead by first patching internet-facing servers and any flaws already under active attack. Factory and utility equipment, with its long maintenance cycles, deserves extra attention.
Replace Legacy Systems
Unsupported platforms are easy targets because they get updates slowly, if at all. The Five Eyes agencies call this outdated tech a strategic liability, demanding prompt action from defenders. A good start is to list outdated software and hardware, then set a replacement timeline.
Strengthen Access Controls
Organizations should require strong sign-ins and regularly review who can access critical systems. Multifactor authentication is one of the easiest wins, especially with security keys or passkeys. Since AI makes attacks easier to run at scale, old accounts and extra permissions can give intruders a simple way in.
Plan for Incidents Before They Happen
Five Eyes guidance treats breaches as inevitable, so written response procedures and trained staff matter. Practice drills, clear roles and tested offline backups can help contain an intrusion before it becomes a crisis.
Staying Secure as AI Keeps Evolving
The labs building new AI models have confirmed the danger themselves. Still, open-weight rivals and everyday AI phishing arguably deserve more attention.
Fortunately, the basics stay useful whatever arrives next. Teams that shrink their attack surface, patch quickly, retire old systems, control access and plan ahead will be better prepared as AI advances.
As the Features Editor at ReHack, Zac Amos writes about cybersecurity, artificial intelligence, and other tech topics. He is a frequent contributor to Brilliance Security Magazine.
Additional Resource
Video Overview
Infographic
Follow Brilliance Security Magazine on LinkedIn to ensure you receive alerts for the most up-to-date security and cybersecurity news and information. BSM is cited as one of Feedspot’s top 10 cybersecurity magazines.