I keep coming back to Cloudflare Just Taught an AI because it affects every part of digital life. I’ve spent years watching AI vendors promise that their models will revolutionise cyber security. Most of the time, the reality falls short. Finding bugs is one thing. Proving they matter is another.
Cloudflare just showed me something different.
They partnered with Anthropic on Project Glasswing, pitting a new security-focused language model called Mythos Preview against their own codebase of over 50 repositories. The results are worth paying attention to.
The Big Leap: Exploit Chain Construction
Previous frontier models could find individual vulnerabilities. They’d spot a use-after-free bug, flag a buffer overflow, report a logic error. But they couldn’t connect the dots. They’d hand you a list of low-severity findings and call it a day.
Mythos Preview does something different. It takes those same low-severity bugs, the ones that would normally sit invisible in a backlog for months, and chains them into a single, working exploit. It can turn a memory corruption bug into full system control through return-oriented programming chains. It writes proof-of-concept code, compiles it, runs it, and iterates until it has working proof or a confirmed dead end.
“What changed with Mythos Preview is that a model can now take those low-severity bugs and chain them into a single, more severe exploit.”
Cloudflare described the model’s reasoning as resembling “the work of a senior researcher.” That’s not marketing fluff. When a model can independently construct exploit chains, it’s operating at a level we haven’t seen before.
The Harness: How to Scale AI Security Research
Here’s where it gets practical. Cloudflare didn’t just throw the model at their code and hope for the best. They built a staged pipeline, what they call a harness, to leverage Mythos Preview’s strengths while managing its weaknesses.
The key lessons:
- Narrow scope beats broad prompts. Telling an AI “find all the bugs” is useless. Telling it “examine this specific function for trust boundary violations” produces results.
- Ask separate questions. “Is this code buggy?” and “Can an attacker actually reach this bug?” are fundamentally different questions. The model performs better when you split them.
- Run parallel narrow tasks. Instead of one agent trying to cover everything, run 50 focused hunters simultaneously, then deduplicate findings.
- Use adversarial review. A second agent with different prompts catches the noise the first one generates.
The pipeline runs through recon, hunting, validation, gap-filling, deduplication, reachability tracing, and structured reporting. It’s methodical. It’s boring. It works.
The Refusal Problem
One finding that caught my attention: Mythos Preview exhibits organic refusals on certain security requests, but they’re inconsistent. Same task, different framing, opposite results. Sometimes it’ll help with an exploit chain. Sometimes it won’t.
This matters because it tells us that model guardrails built into the weights alone aren’t reliable. If you’re building security tools on top of these models, you need additional safeguards. The model’s own judgement about what it should and shouldn’t help with is too unpredictable for production use.
The Signal-to-Noise Challenge
False positives remain the biggest headache in AI-assisted vulnerability research. Memory-unsafe languages like C and C++ generate more false positives than memory-safe languages like Rust. Models tend to over-report hedged findings, words like “possibly” and “potentially.”
Mythos Preview improves on this. It produces clearer reproduction steps and working proofs, which reduces the triage burden on human researchers. When the model can prove a bug exists by triggering it, you don’t waste time debating whether the finding is real.
Why This Matters for the Rest of Us
Cloudflare is one of the few companies with the resources and expertise to do this kind of research properly. The fact that they’re sharing their approach publicly is significant.
The implications are straightforward:
- If AI can chain low-severity bugs into critical exploits, your attack surface just got bigger. Bugs that were “low priority” yesterday are tomorrow’s incident.
- Generic coding agents won’t cut it for security work. The context mismatch between “write features” and “find vulnerabilities” is too large.
- The organisations that benefit most will be the ones that build proper harnesses, not the ones that just point a model at their code and hope.
Cloudflare also flagged a dual-use concern. The same capabilities that let an AI defend your code can be turned against someone else’s. There’s no sugar-coating that reality.
My Take
I’ve been sceptical of AI-powered security tools for a while. Most of what I’ve seen is glorified static analysis with a chatbot wrapper. Project Glasswing is different. It demonstrates genuine reasoning about vulnerability exploitation, not just pattern matching.
The staged harness approach is the real takeaway here. AI security research isn’t about finding a magic model. It’s about building the right infrastructure around a capable model. Narrow tasks, parallel execution, adversarial review, and structured reporting. Boring engineering, not flashy demos.
For security teams watching this space: start thinking about how you’d build a harness for your own codebase. The models are getting capable enough that the bottleneck is shifting from “can AI find bugs?” to “can we operationalise the findings?”
Cloudflare plans to share more about how these architectural principles protect their customers. I’ll be watching.
Related Reading
- Project Glasswing: What Mythos Showed Us (Cloudflare Blog)