AI security startup Depthfirst has publicly challenged Anthropic's flagship model Mythos, claiming its own model not only found multiple severe system-level vulnerabilities that Mythos missed, but did so at one-tenth the cost. CEO Qasim Mithani said the task that costs Mythos $10,000 can be done for just $1,000 with their model — because it is optimized for a single task: finding bugs.
NGINX Bug Lurked for 18 Years; Linux, Chrome Also Hit
The vulnerabilities uncovered by Depthfirst's AI target the internet's core infrastructure. The most striking is a flaw in NGINX, the world's most widely deployed web server, that has been present since 2008 — meaning any NGINX server has been exposed for 18 years. Maintainer F5 Networks plans to release a patch this week. A similar critical flaw was found in the Linux operating system, allowing code execution on affected devices (not yet patched). Multiple high-severity bugs in Google Chrome, exploitable via malicious web pages, were confirmed and fixed by Google. In FFmpeg, the open-source software powering video infrastructure for Netflix, YouTube, Instagram and Spotify, Depthfirst found a dozen new defects that Mythos overlooked.
F5's chief product officer Kunal Anand called it a game changer: "When AI can trace code paths at scale and surface edge cases no human could, every security researcher becomes more powerful. These bugs were always there — now we have better tools."
Rejecting Tech Hoarding, Pledging $5M for Open Defense
Depthfirst, which raised $80 million at a $580 million valuation in March, announced the "Open Defense Initiative," offering $5 million in credits for enterprises and open-source developers to use its AI model for vulnerability hunting — a stark contrast to Anthropic's closed approach of limiting Mythos to 50 firms. CEO Mithani argued that restricting such tech to a few partners "is not right," noting that attackers already wield powerful AI tools, so defenders must leverage every option to prevent digital disasters.
Skeptical Voices: Finding Bugs Is Easy, Fixing Them Is Hell
Not everyone believes AI-driven bug hunting alone solves the cybersecurity crisis. Jean-Baptiste Kempf, a core FFmpeg maintainer, told Forbes that even without AI, finding errors on that platform is trivial. He pointed out the real pain point: "Finding vulnerabilities is simple… the real challenge is fixing them properly."