What we learned from SATAN about the MYTH of Mythos

The talk opens in 1995, when Dan Farmer and Wietse Venema released SATAN, an automated network scanner. Critics feared that giving ordinary administrators a tool that probed networks would mostly help intruders, and the tool's name stoked the panic. The speaker argues that SATAN did not invent new capability so much as compress the time needed to find weaknesses, and that scanners later became routine.

The speaker then maps that debate onto Anthropic's Mythos model and its Project Glasswing rollout, which initially reached roughly fifty companies. Mythos reportedly surfaced a 27-year-old bug in OpenBSD. The speaker contends that gating access rarely stops capable adversaries: leaks are likely across that many organizations, and rival vendors can build comparable systems quickly, as OpenAI did within about two weeks. Earlier fights over strong cryptography and export controls on 56-bit DES show a similar pattern, and the cost of restriction falls on defenders, researchers, and organizations left off the list.

The proposed alternative is responsible disclosure, a model that has worked for about three decades by giving vendors a fixed window to fix flaws before details go public. The speaker suggests that any staged access to AI security tools should be time-limited, tied to a few patch cycles, rather than open-ended. The takeaway is that wider availability of defensive tools has tended to do more good than keeping them quiet.