Yes. Source-code access makes vulnerability research easier, but it is not required. A sufficiently capable agent can learn a great deal from the behavior an application exposes over the internet.
The arrival of Claude Mythos 5 has moved an old cybersecurity question into a more urgent phase.
Anthropic describes Mythos 5 as its most capable model for cybersecurity research and says it can find and exploit software vulnerabilities more effectively than other models and all but the most skilled human experts. Access is currently restricted to vetted partners, with a safeguarded version—Claude Fable 5—made available more broadly. Anthropic’s Mythos overview makes clear that these capabilities are intended for defensive use.
The relevant risk is not necessarily that criminals will obtain Mythos itself. It is that other laboratories will produce Mythos-class capabilities, some models will become widely available, and underground services will provide access with weaker controls.
When that happens, will criminals point these systems at applications whose source code they cannot see?
Almost certainly.
A web application reveals more than its source code
Source access gives a security model an enormous advantage. It can inspect data flows, identify dangerous functions, trace authorization decisions, and understand how server-side components interact.
But attackers have always found vulnerabilities without it.
A public application necessarily exposes behavior:
-
Pages, forms, and navigation paths
-
Client-side JavaScript
-
Browser-visible network requests
-
API shapes and response formats
-
Authentication and account-recovery flows
-
Error messages
-
Differences between user roles
-
State changes caused by particular actions
-
Timing and response variations
-
Product documentation and support material
A capable model can treat each interaction as an experiment. It observes the result, updates its understanding of the application, and decides what to examine next.
This is fundamentally different from a scanner running a fixed list of checks. The model can form hypotheses, abandon weak ones, and spend more time on behavior that appears unusual.
Black-box capability is already being evaluated
This is no longer a purely hypothetical benchmark setup.
OpenAI’s GPT-5.4 system card describes an evaluation in which an agent had to identify vulnerabilities in sandboxed web applications without access to their source code. The model received only a general objective and had to interact with the application remotely. The evaluation covered systems such as content-management tools, e-commerce applications, business software, web infrastructure, and AI applications. The GPT-5.4 system card reports that the tested vulnerabilities were considered relatively straightforward and cautions that benchmark success is not equivalent to reliable exploitation of hardened production targets.
That qualification matters. But so does the result: frontier agents can already perform meaningful black-box vulnerability discovery.
Google Threat Intelligence reported in May 2026 that it had identified what it believes was the first threat actor using a zero-day exploit developed with AI. Google also observed growing adversary interest in agentic exploitation, automated vulnerability research, and premium model access through criminal middleware. Google’s threat assessment describes a shift from experimentation toward industrial application.
The evidence does not show that autonomous models can compromise any application on demand. It does show that AI is entering real vulnerability-research and exploitation workflows.
How a source-less agent would approach an application
At a defensive level, the likely workflow has several stages.
Building an application map
The agent would begin by learning what the application does.
It could enumerate public functions, follow links, inspect client-side behavior, observe network calls, and record how workflows change between anonymous and authenticated sessions.
A human penetration tester does something similar. The difference is that an agent can document every interaction, revisit earlier observations, and repeat the process across many applications.
The result is not source code. It is a behavioral model of the application.
Looking for inconsistencies
Security failures often appear as differences that the product did not intend.
An agent might compare what different users, roles, sessions, or workflow states are allowed to see and change. It could look for mismatches between the user interface and the server’s actual enforcement.
The relevant categories include authorization, session management, input handling, file workflows, state transitions, and business rules. The agent does not need to know the internal implementation initially. It needs to detect that two seemingly similar requests produce unexpectedly different outcomes.
Generating and testing hypotheses
A conventional scanner applies predefined tests. A reasoning agent can select tests based on what it has already learned.
If an application responds in an unusual way, the agent can consider several explanations and design additional observations to distinguish between them. It can decide whether a signal is worth pursuing or probably just noise.
This iterative reasoning is one of the main advantages of Mythos-class systems. They can perform the loop that previously required an experienced human:
Observe, hypothesize, test, interpret, and revise.
Adapting when tests fail
Real applications are messy. Requests fail. Sessions expire. Interfaces change. Defensive systems block activity. Responses contain irrelevant information.
Earlier automation often stopped when an expected condition was absent. An agent can diagnose at least some failures, restore its state, choose a different path, or request help from a human operator.
This does not make the model infallible. It makes it persistent.
Connecting individually weak findings
Many consequential compromises do not depend on one spectacular flaw. They combine several smaller weaknesses.
A model with a long context and durable memory could maintain a graph of observations across accounts, roles, services, and application components. It might recognize that one behavior reveals information that makes another behavior more valuable.
This is also where agents remain unreliable. Chaining findings requires accurate state tracking, patience, and good judgment. Models can still forget constraints, misinterpret responses, or pursue imaginary vulnerabilities.
Scaling across many targets
The largest criminal advantage may be economic rather than technical.
A human expert can examine only so many applications. An organization operating many agents could perform shallow reconnaissance across a large population, escalate promising targets to stronger models, and involve human experts only where the expected return justifies it.
That changes the economics of vulnerability discovery even if the average agent remains substantially weaker than a top researcher.
Which applications would be most exposed?
Mythos-class agents will not affect every application equally.
The greatest near-term risk falls on applications with:
-
Large, poorly inventoried public attack surfaces
-
Old or unpatched components
-
Verbose errors and exposed development information
-
Inconsistent server-side authorization
-
Complex role and account structures
-
Numerous APIs and integration points
-
Weak monitoring across sessions and accounts
-
Predictable business workflows
-
Limited rate and resource controls
-
Dependencies with recently disclosed vulnerabilities
Agents will be particularly effective when an application resembles software represented in their training or evaluation environments. Widely deployed frameworks and products offer transferable knowledge.
Bespoke, well-hardened applications with minimal exposure, consistent authorization, active monitoring, and rapid response will be significantly more difficult.
Where Mythos-class agents will still struggle
The absence of source code remains a serious handicap.
They see effects, not causes
A response difference may indicate a vulnerability—or ordinary application behavior. Without code, the model must infer the internal cause from incomplete evidence.
This creates false positives and wasted effort.
Production environments are noisy
Benchmarks usually provide stable targets and clear objectives. Real applications contain background traffic, distributed services, third-party integrations, changing data, and defensive controls.
OpenAI explicitly notes that current cyber ranges contain less noise and fewer active defenses than hardened real networks.
Stealth is a separate capability
Finding a possible weakness is not the same as investigating it without triggering alerts.
An agent that repeats too many tests, moves too quickly, or behaves consistently across sessions may be easier to identify than a skilled human operator. Models optimized for solving a benchmark are not automatically optimized for operational concealment.
Autonomous reliability remains uneven
An agent may corrupt its own session, lose track of accounts, misread an error, or make an irreversible decision based on a false assumption.
Criminals are therefore likely to keep humans involved for important decisions. The near-term threat is one operator supervising many agents, not necessarily fully autonomous compromise.
Access to the strongest models will be constrained
Mythos 5 is restricted to vetted defensive partners. General-access models such as Fable 5 include additional safeguards, monitoring, and account-level enforcement.
Anthropic has said that Mythos-level cyber capabilities require stronger safeguards than the industry can currently guarantee at broad scale. Its Project Glasswing update predicts that multiple developers may reach similar capability levels.
These controls will not eliminate misuse, but they raise its cost and create opportunities for disruption.
Which models are cybercriminals likely to use?
The model named Mythos is less important than the capability class it represents.
Commercial frontier models
Models from Anthropic, OpenAI, and Google will be attractive because they offer the strongest reasoning, coding, tool use, and long-context performance.
Criminal access will remain fragile. Providers can detect abuse, restrict accounts, preserve logs, and apply specialized cyber-safety systems.
These models are most likely to be used through compromised or disposable accounts, criminal middleware, or human-supervised workflows—not as stable, openly operated criminal infrastructure.
Fable-, GPT-5- and Gemini-class systems
General frontier models may be sufficient for a large amount of black-box research even if they are weaker than Mythos.
Anthropic reported that several other frontier models could identify and demonstrate some vulnerabilities involved in its own review of Fable 5. The company emphasized that those examples did not require unique Mythos-level capability. Anthropic’s safeguard update illustrates how cyber capability is spreading across the frontier rather than remaining confined to one specialist model.
Qwen3.5 and other visual open models
For source-less web applications, visual and computer-use capabilities are unusually relevant.
Qwen3.5 can interpret graphical interfaces, use tools, and operate computers and mobile applications. Because it is available as an open-weight model, it can be placed inside privately controlled agent systems without depending on a central provider.
Its combination of visual understanding, multilingual support, and agent tooling makes Qwen one of the more likely open foundations for black-box application research.
GLM, DeepSeek and Kimi
GLM-5.2 and DeepSeek-V4 offer strong reasoning, coding, long contexts, and agent capabilities. Kimi’s multimodal models add visual understanding and tool orchestration.
Their largest versions require substantial infrastructure. They are therefore more likely to be used by well-resourced groups, hosted intermediaries, or underground services than by ordinary criminals running models on personal hardware.
Smaller open models
A smaller model paired with a good agent framework may pose more practical risk than a larger model used only through a chat window.
Routine work—mapping pages, classifying responses, maintaining notes, and coordinating tests—does not always require frontier intelligence. Criminal systems may use smaller local models for broad reconnaissance and reserve expensive models for the most promising targets.
The surrounding scaffold matters enormously:
-
What observations the model receives
-
Which tools it can control
-
How long it can work
-
How state and memory are maintained
-
How failures are detected
-
When work is escalated to a human or stronger model
The threat is therefore an AI system, not just a model.
The likely criminal operating model
The most credible near-term structure is a funnel:
-
Conventional automation identifies public applications.
-
Inexpensive agents map their exposed functionality.
-
Stronger models analyze unusual behavior.
-
Human specialists review the most promising findings.
-
Automated systems revisit validated targets at scale.
This arrangement reduces the need for expensive frontier inference and compensates for unreliable autonomy.
Mythos-class capability would sit near the narrow end of the funnel, where difficult reasoning has the greatest value.
How defenders should respond
The correct response is not to hide source code more carefully. Most attackers never had it.
Organizations should prepare for persistent, adaptive external testing.
Test from the outside in
Internal code review is essential, but it should be supplemented with continuous, authorized black-box assessment. Defenders need to see what an agent can infer from the same interface exposed to the internet.
Make authorization uniform
Every sensitive object and action should have server-side authorization independent of what the interface displays. UI restrictions are not security boundaries.
Consistency is especially important because agents are good at comparing similar workflows and finding exceptions.
Reduce unnecessary behavioral clues
Production systems should avoid exposing debugging information, internal identifiers, stack details, or inconsistent error behavior where it provides no user benefit.
This will not prevent research, but it can make inference more difficult.
Monitor sequences rather than signatures
AI-generated activity may vary enough to evade fixed request signatures. Detection should examine sequences of actions, relationships between accounts, unusual exploration patterns, repeated state changes, and activity distributed across identities.
Build resource-level controls
Rate controls should cover accounts, application objects, identities, API tokens, payment instruments, and shared destinations—not only IP addresses.
Patch against machine-speed rediscovery
Once a vulnerability or affected component becomes public, defenders should assume that agents can rapidly translate disclosure into target identification and validation.
Asset inventory and patch deployment time will become increasingly decisive.
Use high-confidence tripwires
Unused endpoints, impossible workflow transitions, and decoy resources can provide early warning when an automated system is exploring beyond ordinary user behavior.
Limit the blast radius
Strong isolation, least privilege, segmented services, narrowly scoped tokens, and constrained administrative functions reduce the value of any single application weakness.
The conclusion
Cybercriminals will use Mythos-class models against applications whose source code they cannot access.
They will not need to reconstruct the entire codebase. They will build a behavioral approximation from pages, APIs, state transitions, roles, errors, and responses. The model will then use that approximation to prioritize anomalies, test hypotheses, recover from failures, and escalate promising findings.
The first major effect will not be an autonomous agent flawlessly compromising every target. It will be a dramatic increase in the number of applications that can receive patient, adaptive attention.
Mythos 5 itself is unlikely to become an ordinary criminal tool because access is restricted. The more realistic danger comes from the diffusion of similar capabilities into commercial frontier models, criminal access services, and eventually open-weight systems.
Applications that depend on obscurity, inconsistent authorization, slow patching, or the assumption that attackers cannot afford careful manual exploration will be most exposed.
Source-code secrecy still has value. It is no longer a reason to assume that sophisticated automated vulnerability research cannot happen.
