disclosure<\/a> last month about Claude Mythos\u2014and subsequent disclosures about the capabilities of Anthropic\u2019s Opus 4.7 and OpenAI\u2019s GPT 5.5\u2014suggest that a flood of new vulnerabilities are likely to be uncovered in major software tools in the coming months, CrowdStrike executives have said this week during the Americas Partner Symposium event.<\/p>\nEven with the guardrails that Anthropic and OpenAI have introduced, \u201cmake no mistake\u2014adversaries will at some point get access to the latest state of the art AI capabilities,\u201d Zaitsev said Wednesday. \u201cI\u2019m confident it\u2019s a matter of when\u2014not if.\u201d<\/p>\n
Partner Perspective<\/p>\n
Solution and service provider executives told CRN that CrowdStrike\u2019s rare level of access to frontier AI models\u2014combined with its agnostic approach to leveraging those models\u2014is a huge value for the vendor\u2019s partners.<\/p>\n
What CrowdStrike is providing is a crucial security foundation that is flexible enough to deal with AI-accelerated cyber risk going forward, according to Bill Fryberger, principal and Americas cybersecurity advisory leader at EY.<\/p>\n
For all the attention that Anthropic\u2019s Claude Mythos model has received, there are indications that OpenAI\u2019s GPT 5.5 may be even more proficient for vulnerability research and exploitation, Fryberger said.<\/p>\n
In other words, as the leading AI model of the moment inevitably changes, having EY try to chase that is \u201cnot a good business for me to be in,\u201d he said.<\/p>\n
If EY tells a client one day that it\u2019s all-in with Claude, the firm can\u2019t tell that client later that week, \u201cI was just kidding on Monday, I\u2019m really going down the OpenAI route,\u201d Fryberger said. \u201cI\u2019ve got to choose my foundation.\u201d<\/p>\n
The clear message from CrowdStrike is that it is building its platform around the use of AI, \u201cwhatever frontier model that ends up being,\u201d he said.<\/p>\n
\u201cIt just makes it easier for me to have a conversation with the client,\u201d Fryberger said. \u201cWe\u2019re just providing a flexible foundation where you can be comfortable that we\u2019ll use the best we can at the time.\u201d<\/p>\n
Indeed, CrowdStrike is meeting a crucial need by becoming the agnostic \u201corchestrator for proactive security,\u201d said Mark Grassmann, national cybersecurity practice principal at Alchemy Technology Group, a Houston-based partner of CrowdStrike.<\/p>\n
\u201cI think CrowdStrike has put itself in a pole position by adopting this approach and being flexible with the [AI] models,\u201d Grassmann said.<\/p>\n
All in all, \u201cbeing the indispensable platform or orchestrator for a customer to adopt this extremely futuristic, modern technology\u2014that\u2019s the right place to be,\u201d he said. \u201cAnd as a partner, that gives us confidence that they\u2019re the right platform of choice to recommend and advise our customers around.\u201d<\/p>\n
Older Models Are Still Proficient<\/p>\n
In addition to the fact that the frontier AI models are rapidly evolving, there are also indications that the previous generations of the models have already been very effective at offensive security, Zaitsev said Wednesday.<\/p>\n
That is, \u201cI don\u2019t really think these are new risks,\u201d he said. \u201cEven before the mass availability of highly capable artificial intelligence systems, we\u2019ve been documenting a trend over the last few years of the collapse in mean time to exploitation. The number of vulnerabilities that have been continuing to climb.\u201d<\/p>\n
Where some of the newer models such as Claude Mythos most stand out, perhaps, is that \u201cthey have also had their guardrails deliberately reduced to support specific cybersecurity use cases,\u201d Zaitsev said.<\/p>\n
At the same time, there is widespread speculation about what the frontier AI models are actually capable of, he said.<\/p>\n
\u201cVery few individuals in the world have actually had their hands on any of these models, let alone all of them. But I have,\u201d Zaitsev said.<\/p>\n
Without a doubt, the latest generation of models are more capable at coding and reasoning, as well as at executing complex cybersecurity use cases, he said. This is both because of improvements and due to the reductions in guardrails, according to Zaitsev.<\/p>\n
However, where the latest frontier models are \u201cparticularly good [is] at chaining together existing vulnerabilities and identifying these non-obvious attack paths, as well as some reverse engineering tasks,\u201d he said.<\/p>\n
The AI model harness\u2014consisting of components such as prompts, sub-agents, tools, plugins and skills\u2014is also pivotal and not something that has received enough recognition, Zaitsev said.<\/p>\n
Mythos Is \u2018Not Cyber AGI\u2019<\/p>\n
CrowdStrike\u2019s own testing suggests that some of the recently released models are \u201cmore incremental than revolutionary,\u201d Zaitsev said.<\/p>\n
Even the prior version of Anthropic\u2019s publicly available model, Opus 4.6, was \u201calready able to do virtually everything that Mythos can do when we paired it with the right harness,\u201d he said.<\/p>\n
Referencing the widely discussed prediction of super-advanced artificial general intelligence (AGI), Zaitsev said it\u2019s ultimately clear that \u201cMythos is not cyber AGI.\u201d<\/p>\n
Mythos \u201cstill makes mistakes. It generates a lot of false positives when not used correctly,\u201d he said.<\/p>\n
CrowdStrike testing found that the false positive rate while analyzing vulnerabilities with Mythos varied from between 20 percent and 80 percent, with the variation depending on the harness that was being used, Zaitsev said.<\/p>\n
Additionally, \u201cMythos is painfully slow and incredibly expensive to use,\u201d he said. \u201cIt\u2019s a huge problem.\u201d<\/p>\n
But there\u2019s still no question, Zaitsev said, that Claude Mythos does make it \u201ceasier for less-skilled users\u2014people who don\u2019t have any harness at all\u2014to become dangerous quicker.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"As Anthropic and OpenAI compete to have the upper hand on AI-powered vulnerability discovery, CrowdStrike is \u2018working on…\n","protected":false},"author":2,"featured_media":30525,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6744,24,405,399,3013,25,402,8916,12722,313,9955,9954,223,415,400,401,404,414,318],"class_list":{"0":"post-30524","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-agi","8":"tag-agi","9":"tag-ai","10":"tag-ai-agents","11":"tag-application-and-platform-security","12":"tag-artificial-general-intelligence","13":"tag-artificial-intelligence","14":"tag-cloud-platforms","15":"tag-cloud-security","16":"tag-cyberattacks","17":"tag-cybersecurity","18":"tag-data-protection","19":"tag-endpoint-security","20":"tag-generative-ai","21":"tag-llm","22":"tag-managed-security","23":"tag-managed-service-providers","24":"tag-saas","25":"tag-security-operations","26":"tag-vulnerabilities"},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/30524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=30524"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/30524\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/30525"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=30524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=30524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=30524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\".\/media_1bd20b706cdc1c995e94b9836d3d0ff90a865407f.png?width=750&format=png&optimize=medium\")
<\/p>\n