Claude Mythos Achieves 73% Success Rate on Expert-Level Cybersecurity CTF Challenges
A cybersecurity analysis has found that Claude Mythos Preview achieved a 73% success rate on expert-level capture-the-flag (CTF) cybersecurity challenges — a benchmark category that no AI model could complete at all before April 2025, according to a new assessment of the model's security capabilities. CTF challenges are used by professional security researchers to test offensive and defensive cybersecurity skills; expert-level CTF problems require the ability to identify obscure vulnerabilities, write working exploit code, and reason through multi-step attack chains that approximate real-world penetration testing scenarios. The 73% success rate represents a qualitative leap in AI security capability that has significant implications for both offensive security research and the defensive use of AI in cybersecurity.
What CTF Performance Means for AI Security Capabilities
Capture-the-flag competitions are structured cybersecurity challenges where participants find hidden "flags" — strings of text — by exploiting vulnerabilities in intentionally vulnerable systems. Expert-level CTF problems draw on the same skill set used by professional penetration testers and red team operators: vulnerability identification, exploit development, binary analysis, cryptography, and web application security. The fact that no AI model could complete expert-level CTFs before April 2025, and that Claude Mythos Preview now completes 73% of them, indicates the model has developed capabilities that were previously exclusive to trained human security professionals.
Anthropic's Project Glasswing, which uses AI to identify vulnerabilities in critical software, represents the defensive application of these same capabilities. The CTF benchmark results suggest Claude Mythos Preview has the technical depth to operate as a meaningful security research assistant — capable of reasoning through vulnerability chains and generating working exploit primitives that security teams can use to find and fix weaknesses before attackers can exploit them.
The Dual-Use Security Implication
A model that can solve expert-level CTF challenges is a model that has developed meaningful offensive security capability. This creates the dual-use tension that has become a recurring theme in frontier AI development: the same capabilities that make Claude Mythos Preview useful for legitimate security research also lower the barrier for malicious actors to develop and deploy cyberattacks. Anthropic has published usage policies restricting the model from assisting with unauthorized system access, but the gap between policy restrictions and technical capability is a persistent challenge for AI safety. The CTF benchmark results will intensify the debate about how AI companies should handle models with demonstrated offensive security capability.
Frequently Asked Questions
What is a capture-the-flag challenge?
CTF challenges are structured cybersecurity competitions where participants find hidden "flags" by exploiting vulnerabilities in intentionally vulnerable systems. Expert-level CTFs test skills like vulnerability identification, exploit development, and binary analysis — the same skills used by professional penetration testers.
What does Claude Mythos Preview's 73% CTF success rate mean?
It means Claude Mythos Preview can solve nearly three-quarters of expert-level cybersecurity challenges that required trained human professionals before April 2025. No AI model could complete these challenges at all prior to that date.
Is Claude Mythos Preview dangerous for cybersecurity?
The same capabilities that enable expert-level CTF performance also create dual-use risk. Anthropic restricts the model from assisting with unauthorized system access, but the technical capability gap between what the model can do and what its policies permit creates ongoing challenges for AI safety governance.
The Bottom Line
A 73% success rate on expert-level CTF challenges is not a marginal improvement over previous AI security performance — it is a phase transition. The cybersecurity capabilities demonstrated by Claude Mythos Preview represent the emergence of AI as a genuine peer to trained human security professionals in offensive research contexts. The defensive applications are compelling: AI-assisted penetration testing, automated vulnerability discovery, and AI-powered red team operations could dramatically accelerate the pace of security hardening for critical systems. The offensive risk is equally real, and the cybersecurity industry, AI developers, and regulators are not yet aligned on how to manage AI models that can operate at expert level in security domains.