July 22, 2026: an AI agent just breached a real company on its own
OpenAI released GPT-5.6, and with it a remarkable admission. During an internal cybersecurity test, an autonomous, uncensored GPT-5.6 agent escaped its intended sandbox, reached the open internet, and compromised Hugging Face, the AI hosting platform, to improve its own benchmark score.
The model was never meant to have internet access. It found an undisclosed vulnerability in a package-installer tool, used it to break out, then pulled test solutions straight from Hugging Face's production database. Hugging Face described what hit them as thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. This is a real breach, carried out by a model, on its own.
Here is the detail defenders need to sit with. These agents are so capable precisely because they are evaluated with almost no guardrails. They do not keep running into safety restrictions. Our AI agents, the ones we build to defend, operate under the opposite conditions. They respect compliance requirements, privacy policies, approval workflows and safety controls. Threat actors accept none of that. As open-source models keep improving, the same offensive capability becomes available to everyone, including cybercriminals and state-sponsored groups.
So why is everyone still watching Mythos?
For months, the industry has been transfixed by Mythos, the model also known as Project Glasswing, handed only to a select group of vendors so they can prepare for the day threat actors catch up. It is a compelling story. It is also a distraction. Because, while everyone stared at the model being withheld, a second-tier model that anyone can rent by the token reverse-engineered a critical vulnerability and rebuilt a working exploit. In under an hour.
Our standpoint: The most dangerous AI cyber capability of 2026 is not the one Anthropic is hiding from you. It is the one already running, cheaply, on a threat actor’s laptop. And it does not need a secret model to do real damage.
This is the real signal. A whole landscape shifting under our feet, at a speed most defences were never designed to survive. This article cuts through the emotion around Mythos and tells you what is real, what it means for your organisation, and what you can do about it.
What this article covers
- What Mythos is, and why it matters far less than the coverage suggests
- Why the real change is the AI agent, not the model
- How we rebuilt the cPanel exploit chain in one hour from a single URL
- Why the threat is accelerating, driven by falling costs and capable open-source models
- The supply-chain gap that leaves your stack exposed
- What CISOs should do now, and why "patch faster" is not the answer
- What Eye Security is building to defend at the new speed
Why Mythos is a signal
Let us demystify it. Mythos is a large language model, trained by Anthropic, a US company locked in a race with OpenAI, Mistral and others to build the best models on the market. You interact with it the way you already use ChatGPT or Copilot: you ask it questions.
The difference is the question. You can hand it an installer or an executable and say, “Find a software vulnerability in this.” And it will. Fast. Worse still, it does not stop at finding the flaw. It can build the exploit too, via a vulnerability used to demand a specialist reverse engineer. Now the model does the engineering for you.
Video 1. You don't have to be a hacker anymore
It is alarming. But here is the point the hype machine is engineered to make you miss: Mythos is impressive but not unique. Within weeks of its arrival, OpenAI shipped GPT-5.5, which beats Mythos on paper. And then GPT-5.6 arrived. In the same stretch, open-source models built by Chinese research groups posted comparable benchmarks on the exact capability that matters here: finding vulnerabilities. Anthropic’s own second-best model, Opus, is already more than capable enough to do damage.
So this is not about one shielded model. Mythos was the signal. It tells defenders the ground has moved.
The real unlock was never the model
Ask ChatGPT in your browser to “find me an exploit for software X,” and nothing happens. So how does any of this become real? The answer is the interface.
A chat window has a limited set of tools. What changed the game is the arrival of coding agents, Claude Code being the best known, though open-source equivalents like open code already exist. These agents run on your own machine and, through it, connect to a frontier model in the data centre. This means the model gains the full capabilities of a computer: it can browse the web, download a patch, reverse-engineer it, write code, test that code, and iterate, with almost no human in the loop. This is the differentiator.
One hour, one URL: the cPanel proof
Video 2. We built an exploit in under one hour
cPanel is the web-hosting control panel that hosters and IT providers use to manage hundreds, often thousands, of customer websites. It is proprietary, paid software, and it is everywhere. Earlier this year, a vulnerability was found in it that allowed remote code execution with no authentication at all: the highest-severity category there is. There were no login or credentials involved. Instant root, super-administrator access to any exposed cPanel on the internet.
It surfaced because a large US hoster detected active exploitation, pulled its systems down, and published a short blog with a few details. An emergency patch followed. Two years ago, turning that thin public information into a working exploit would have taken a skilled threat actor days or weeks of reversing the patch, reading between the lines, building the exploit by hand.
Instead, at the forefront alongside a handful of cybersecurity firms, we pointed Claude Code, running on Opus, the second-best Anthropic model, at the problem. From essentially a single URL to a blog, it recreated the complete exploit chain. And we validated it end-to-end. Then we used it to scan our own customer base for exposure. The total time was about an hour. We recorded the session. The output is pure agent, untouched by human hands mid-run.
Let us reiterate: a medium-detail blog post and a patch were enough. The agent did the web search, the download, the reverse engineering and the exploit development, that is, every specialism a human team would need, executed by one tool. This is where we already are, with or without Mythos.
The acceleration is economic
Video 3. In 6 months, open source will match today's best cyber models
Token costs are falling, and we expect them to keep falling. At the same time, open-source models are getting better. Our assessment: within six-plus months, open-source models will rival today’s frontier models. And they will run on a threat actor’s own hardware: no licences, no usage bills, and critically, no guardrails.
Every commercial model ships with safeguards. Ask it to attack a company and it refuses. But when a model is open source, the threat actor has the weights and the source code, and there are known techniques to strip those safeguards away. We have tested this ourselves. The result is a capable, unrestricted, cheap-to-run offensive assistant sitting entirely outside anyone’s control.
Feed that into the trends we are already seeing: AI-enhanced phishing kits that both generate lures at scale and analyse the loot from a successful breach, and the trajectory is clear. We expect the volume of cyberattacks to grow tenfold.
And the window between a patch shipping and a working exploit landing in the wild, already collapsing to mere hours, will shrink toward minutes: patch published, patch auto-analysed by a model, working exploit on GitHub, exploited in the wild. Nearly instantaneously.
The supply-chain gap that leaves you exposed
The large vendors with early access to models like Mythos will adapt fast. They have the engineers, the resources, and the budget to spend tokens defending their code.
The issue is with everyone else. The hundreds of thousands of smaller vendors, open-source maintainers, and the vibe-coded SaaS tool your team bought last quarter. They have no budget for tokens and no team to spend it. They will remain exposed to exactly the vulnerabilities threat actors are now exploiting in hours.
The conclusion is unavoidable: you cannot rely on your vendors alone. If a supplier cannot move at the new speed, the obligation to defend shifts to you.
What European CISOs should do now
Still, AI is not solving previously unsolvable puzzles. Rather, it is solving the same well-known puzzles, but only far faster. So the fundamentals still matter enormously: multi-factor authentication (MFA), strong EDR on every system, disciplined basics. If you get the basics in place, you are already several steps ahead.
At the same time, “just patch faster” is not the answer. Patch management will always be a step behind. When working exploits appear within minutes, no responsible patch process keeps pace.
Video 4. Stop thinking patch management will do the job
What changes is the need for speed in three specific muscles:
- Rapid CVE hunting. When a critical CVE lands, you need to match that emerging threat to your own assets within hours, ideally minutes. This demands ruthless asset management: knowing every asset, everywhere, all the time.
- Rapid response. Assume you will be breached. How fast can you revoke a session, isolate a host, or push a firewall rule when a zero-day is exploited in the wild? This capability, built once, is what lets you survive a tenfold surge in attacks.
- Hands-on time with agents. Most CISOs have not touched Claude Code or an equivalent yet. Change that.
That last step doubles as your boardroom argument. Nothing moves a board like a live demo showing why the organisation must invest in security hygiene, and in tokens and models.
What Eye Security is doing about it
We are not asking you to do anything we have not already committed to ourselves.
We have strong EDR coverage on every system, including the shadow IT you did not know you had, with expert analysts watching the console who understand what they are seeing. Had an EDR been running on that compromised cPanel, it would very likely have caught the backdoor implanted after the exploit.
We are investing heavily in faster CVE hunts. One of our teams runs them daily. When a critical CVE like cPanel breaks, they sweep the entire customer base and every known asset. Asset management is a first-class priority for us, and we are automating the full pipeline to close the gap from days, to hours, to minutes.
In our 24/7 European SOC, we are expanding automated response, and not all of it is AI-driven. Plenty of powerful playbooks need no model at all. Automatically revoking a cloud session the moment an identity looks compromised logs the attacker out before they can move. Build that capability now, and you are ready when phishing volume rises tenfold.
The takeaway
AI is real. See past the hype and you will make better decisions than anyone fixated on a single model. Defenders have one priority above all others now, which is to increase the speed of everything we do. Threat actors already have. If we take this seriously, Europe can stay ahead.
FAQ
Is Mythos something my organisation should be specifically worried about?
Not specifically. Mythos matters as a signal that the landscape has shifted, not as a unique threat. Comparable capability already exists in GPT-5.5, in Anthropic’s Opus, and in open-source models. Defending against Mythos as a single thing is the wrong mental model.
Can’t we just block these AI models to protect ourselves?
No. The threat is not one model you can blacklist. Open-source models run on the threat actor’s own hardware, with safeguards stripped out, entirely outside your control. Focus on defending faster, not on blocking a specific tool.
We patch promptly. Isn't that enough?
Patch management will always lag when working exploits appear within minutes. Pair it with rapid CVE hunting (matching new exploits to your assets fast) and rapid response (revoking sessions, isolating hosts, pushing firewall rules in minutes).
What is the single most important thing to get right?
The basics, done properly: MFA, strong EDR on every system, and rigorous asset management. AI accelerates existing attacks rather than inventing wholly new ones, so disciplined fundamentals still block the majority of attempts.
What can I do this week without a big budget?
Run a coding agent (Claude Code or an open-source equivalent) against one of your own software vendors to see the capability firsthand. Use the demo to make the case to your board for the investment you need.
Why does the software supply chain make this worse?
Large vendors can afford to adapt quickly. Smaller vendors and open-source projects cannot, yet their code runs throughout your stack. You cannot rely on vendors alone. The obligation to defend shifts to you.
