8 small models found the OpenBSD bug that Mythos did

aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier

The FreeBSD NFS remote code execution vulnerability (CVE-2026-4747) is the crown jewel of the Mythos announcement. Anthropic describes it as "fully autonomously identified and then exploited," a 17-year-old bug that gives an unauthenticated attacker complete root access to any machine running NFS.

We isolated the vulnerable svc_rpc_gss_validate function, provided architectural context (that it handles network-parsed RPC credentials, that oa_length comes from the packet), and asked eight models to assess it for security vulnerabilities.

Eight out of eight. The smallest model, 3.6 billion active parameters at $0.11 per million tokens, correctly identified the stack buffer overflow, computed the remaining buffer space, and assessed it as critical with remote code execution potential. DeepSeek R1 was arguably the most precise, counting the oa_flavor and oa_length fields as part of the header (40 bytes used, 88 remaining rather than 96), which matches the actual stack layout from the published exploit writeup. Selected model quotes are in the appendix.

It also found a lot of the other vulnerabilities, but when I posted that, this got deleted. Surprise surprise.