GLM-5.2, not Mythos, is the real security emergency

Until last week, attackers faced a dilemma in using frontier models: even if they could manage the cat-and-mouse game of setting up fake accounts to retain API access to frontier model providers, and even if they could induce models to help them hack via creative prompting, their usage was logged, so if discovered after the fact, their tactics, techniques, procedures, goals, and targets would be exposed to defenders.

The cost of using frontier models, in other words, was the cost of hiding in a panopticon, and the risk that one’s intentions and secrets would be revealed after the fact. That dilemma seems to have been costly enough to help limit attackers’ use of the agentic AI revolution of the past nine months.

GLM-5.2 has relieved attackers of this dilemma. It’s the first open-weights model widely embraced as capable of the long-horizon agency that exploded onto the scene last November with Opus 4.5 and which benign software developers discovered while vibe-coding over the holiday break. Many report GLM-5.2 is as good as, or nearly as good as, GPT-5.5 and Opus 4.8, and at the kinds of code and terminal operations that form the bread and butter of offensive cyber operations.

Fine-tuning GLM-5.2 to say ‘yes’ to any request should be trivial. And one can run GLM-5.2 privately on 8 H200s in a warehouse somewhere. As quantized and pruned versions of the model are released it'll take even less capital. TL;DR: two weeks ago there was serious friction to attackers using agentic AI in earnest. As of last week, there is no stopping attackers from carrying out long-running, Claude Code–level security tasks from the shadows.

Access to near-frontier open weights offensive cyber agents is being democratized just as access to the frontier has been regulated

We can now expect a dark economy to emerge around serving open weights near frontier models via API, just as we have dark economies around malware, zero-day exploits, credential dumps, and initial access into victim networks. We can expect an economy of harnesses and inference providers to emerge. As this occurs, the technical frictions to adopting agentic AI will have been removed for a wide variety of attacker constituencies.

Meanwhile, we have denied cyber defenders access to our most advanced frontier model, Anthropic’s Mythos, on the supposed grounds that this model—which runs on private servers, where it’s watched by active, 24x7 teams dedicated to catching its misuse in a way that benefits the US and its allies, would benefit attackers.

And, even crazier, we’ve shut down this model on the basis of its ability to find zero-days—even after watching the defender community rally around fixing discovered bugs with frontier models far faster than attackers have exploited new zero-days in the wild.

The opportunity available to attackers today

Cyber security today is defined by three clusters of goal-oriented behavior:

• stealing money from individuals via scams, fraud, and commodity malware;

• stealing money from organizations via targeted ransomware campaigns;

• and achieving intelligence, influence, and kinetic goals against national interests via state and quasi-state campaigns.

Supporting all three is an increasingly complex dark economy of access brokers, payment rails, and cyber-weapons marketplaces.

Most of this ecosystem isn’t bottlenecked by any one task but could be deeply transformed by private agentic AI to help across multiple tasks. Here’s what potentially gets disrupted with GLM-5.2-level capabilities and beyond:

• A Claude Code–style, semi-autonomous kill-chain execution capability in which actors manage teams of hacking agents through the various stages of breaking into, persisting on, and expanding access across victim networks between trips to the coffee machine. Anthropic documented such workflows in their vibe-hacking post and their report on the first AI-orchestrated cyber espionage campaign. With private inference, zero guardrails, and better open models than existed when Anthropic wrote those reports, we can expect more of this.

• A Claude Code like semi autonomous experience in authoring implants and command and control infrastructure (documented by CrowdStrike) and a Claude web interface style autonomous experience in authoring just in time one off scripts and binaries (documented by Google) that are tactically useful to a given operation.

• The ability to find zero-days in the shadows and develop reliable exploits for them—around initial access, privilege escalation, and lateral movement—removing friction from the semi-autonomous cyber operations described above.

• The ability—with fine-tuned, open-weights frontier models—to run long-con pig-butchering, scam, and fraud relationships with marks in convincing vernacular and with minimal human-in-the-loop supervision.

What to expect and what we should do

We need to move beyond a discourse focused on denying frontier access to attackers, toward one centered on helping defenders win the race to adopt AI, even if that sometimes means attackers reach closed, API-gated frontier models too.

Pivoting to diffusion means two things: direct AI adoption inside CISO organizations, and innovation from the product and service vendors who supply them. We don’t yet have a cyber-defense product market that force-multiplies defender labor in all the ways the models support, so the best models need to reach the vendors building this marketplace, too. Only the efficiency gains AI affords give defenders a real chance to pay down security tech debt and build the detection-and-response innovations that will let us win against AI-enabled attackers.

The problem isn’t to put the AI agent genie back in the bottle; it’s to make the genie ubiquitous across defender networks, hardening our positions before the cyber-attack world has its own Claude Code automation moments. Those moments are inevitable, and they’re likely to come this year.

-

Thanks for reading. I added a paid subscription option to this blog. More people becoming paid subscribers will show me that you care, and guilt-hack me into writing on a regular basis, not just when I have the time and inspiration. Thoughtful comments and discussion are an appreciated incentive as well!