New benchmark shows Claude Mythos and GPT-5.5 can develop real browser exploits autonomously

Editor's take

An autonomous AI agent, specifically Carnegie Mellon's Mythos, demonstrated a significant capacity to discover and develop real browser exploits against Google's V8 engine, outperforming OpenAI's GPT-5.5 in this specific adversarial task. This development underscores the accelerating capability of AI to engage in complex, security-sensitive operations, moving beyond theoretical threats to tangible vulnerabilities. The disparity in performance and cost between Mythos and GPT-5.5 highlights the trade-offs in current AI agent development, with specialized, expensive models achieving superior results in targeted domains.

The implications extend to both offensive and defensive cybersecurity. While this research showcases potential avenues for AI-driven vulnerability discovery and patching, it also illuminates the increasing sophistication of automated attack vectors. The fact that these agents can autonomously develop exploits, rather than merely identify them, raises concerns about the speed at which new threats could emerge and proliferate.

Future research should focus on quantifying the rate of exploit development and the potential for these agents to discover novel, previously unknown vulnerabilities. Understanding the specific architectural differences that allow Mythos to outperform GPT-5.5 in this adversarial context will be crucial for developing effective countermeasures. The economic viability of deploying such AI for offensive purposes, even with high associated costs, warrants continued scrutiny.