Cybersecurity Now Works Like Proof of Work

Anthropic's LLM Mythos moved faster and more precisely than humans in a complex network attack simulation, presenting the argument that the cost structure of cybersecurity is changing.

In an evaluation by the AI Security Institute (AISI), Mythos completed The Last Ones, a 32-step enterprise network attack simulation, in 3 out of 10 runs. The tests used 100 million tokens (about $12,500) per attempt, and among multiple models, Mythos was the only one that actually finished the entire attack. It was also observed that performance improved as the token budget increased.

Core claims:

• Security is now converging on a matter of resource investment rather than creativity.
• Since defense requires using more tokens than the attacker invested, the structure comes to resemble Proof of Work in cryptocurrency.
• Even as inference efficiency improves, defense costs don't easily decrease for high-value attack targets.

This trend has become more prominent following supply chain attacks like LiteLLM and Axios, and some are even proposing directions such as replacing open-source dependencies with LLMs or investing more tokens into hardening code. Karpathy's remark about "reassessing dependencies" also adds weight to this discussion.

The development process itself may change too. In addition to today's develop → code review flow, a develop → review → hardening stage may become standard going forward. In the final stage, automated vulnerability discovery would run up to whatever the budget allows, and the limits of security hardening would be determined by cost rather than technology.

In the comments, there were also counterarguments and additions to this claim. It was pointed out that defenders can control the entire source and thus respond more efficiently, like scanning at the PR level, whereas attackers must complete a new chain each time, creating a cost asymmetry. Conversely, there was also a counterargument that since attackers only need to find a single vulnerability, economies of scale favor the attacker.

Ultimately, this piece reinterprets AI-era security as a competition over tokens and budgets, and as a problem of hardening-centered workflows that weave security into the development process.