Mythos-Level Hacking Goes Open Source While Weapons Firmware Is Still Tested with Bench Rigs and Checklists (Metalware)

▶ Watch on YouTube · YC Root Access · 6:10

The defense industrial base of the future will be built by small, fast-moving teams working on some of the hardest problems in national security.

Live from Washington, D.C., Y Combinator brings together founders, senior government officials, and military leaders for a day of conversations about rebuilding America’s defense industrial base, working with the government, and closing critical capability gaps across autonomy, munitions, space, secure communications, manufacturing, and more.

— Channel description, YC Root Access (event description; this page covers one chapter)

A six-minute founder pitch from YC Root Access’s day-long livestream on the US defense industrial base (see the event page). Ryan Chow, co-founder and CEO of Metalware, a Bay Area cybersecurity company, presents its work on “defending the embedded stack”: the firmware that runs the components, sensors and controllers inside munitions, aircraft and drones. The founders built offensive capabilities for the US intelligence community; the company now automates those methods so that military defenders can find vulnerabilities in their own platforms first.

It earns its own page for one claim and one argument. The claim: that AI vulnerability discovery at the level of Anthropic’s Mythos is now available to anyone as a downloadable model. Chow attributes it to an Anthropic report published the day before the talk. Jones forecast an open-source Mythos in May; this talk reports it as arrived, on Anthropic’s authority. The argument: why a defender can’t simply point a frontier model at weapons firmware. His three reasons mark where a general model stops in a specialised, air-gapped domain.

TL;DR

• The capability is commoditizing. Anthropic announced Mythos “back in the spring”, and “it obviously found a ton of vulnerabilities, uh, in code bases that were very old” (2:08:01). The news, in his framing: “what’s changed in the last few weeks that many may not know is that these capabilities are commoditizing” (2:08:17).
• The report he cites. “Anthropic published a report literally yesterday saying that Mythos-level capabilities are now available for download, open source, for all of our adversaries to use, with similar performance to Mythos” (2:08:24), and “that adversaries are only a couple months behind the US capabilities on the frontier” (2:08:36). He does not name the model or the report aloud; his slide does (GLM-5.3; Anthropic, 29 September 2026). See Visual canon for the slide and Debates for what the report says.
• Defenders lack the tools. “In short, adversaries have frontier-level hacking tools.” Inside the Department of War, the services he works with “are lacking the tools. They’re using bench rigs and checklists” (2:08:44).
• Firmware is a harder domain. The reasons he gives: “lack of updates, legacy code bases, uh, lack of access, uh, and obviously the dependency on having hardware in the loop” (2:09:14). A munition, drone or aircraft holds “hundreds of small, essentially embedded computers” (2:09:28). The cyber requirements applied to them, RMF and ATO, come from enterprise IT: “there are no login pages for, uh, an aircraft or a munition. A lot of these standards do not apply and are outdated when it comes to actual physical hardware security” (2:10:00).
• The product: offensive methods, automated. “What we’re doing now is taking these tactics, techniques, and procedures, automating that in order to enable scale for our defenders across the armed services” (2:10:33), with research done alongside the Air Force Research Lab (2:10:54). The tools go to the prime contractors, to the services’ verification and validation teams, and to cyber and penetration-testing teams (2:12:16); the end users are “cyber engineers and developers”.
• Why not just use frontier models? “We get asked this a lot” (2:11:12). Three answers. “If adversaries are using these frontier models against our systems, we want to have something better”. On embedded code, “They were not trained on this type of code. It’s a different technical domain” (2:11:31). And weapons testing happens “in an air gap high-side environment. How do you get access to AI in those environments?” (2:11:40). The slide behind him lists six reasons, not three (see Visual canon).

Visual canon

The pitch is slide-led: Chow speaks over sixteen slides, and the figures, the sources and the product claims are on the slides, not in the narration. Sixteen stills were cut and ten are published here. The six dropped are the title and closing cards, a platform anatomy (2:09:41), the Havoc workflow diagram (2:11:09), a screenshot slide too small to read (2:12:13) and a logo wall (2:13:10); what the middle four add is noted under the neighbouring entry. Each entry was transcribed from the still and checked against it. Gemini’s reading was corrected where it mattered: the title card’s date (read as 2024; it is 30 September 2026), model obliteration on the GLM-5.3 slide (it is abliteration), and the analyst screen, which Gemini summarised in one bracketed line and which is transcribed here from the pixels. The stills come from a second targeted search over this chapter, run after a fix to how the search parses Gemini’s timestamps (see the manifest’s Found at stage lines).

1 · Mythos Preview, in numbers

Still at 2:08:14 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

AI now finds vulnerabilities at machine speed. In April, Anthropic gave Claude Mythos Preview to companies and pointed it at the software the world runs on.

• 6,202 high or critical vulnerabilities, across 1,000+ open-source projects, over 90% validated as real
• 27 yrs: age of a bug it found in OpenBSD, plus flaws in every major operating system and browser
• Billions of devices run wolfSSL, an embedded crypto library containing a certificate-forgery flaw

Sources: Anthropic, Project Glasswing announcement (Apr 2026) and update (May 2026).

Still vs. transcript: the narration says Mythos found “a ton of vulnerabilities” in old code on “millions and billions of devices”. The slide gives the count, names the programme (Project Glasswing) and cites two Anthropic posts. Its example is wolfSSL, an embedded library, the case nearest Metalware’s market. The figures are the slide’s; they were not checked against Anthropic’s posts.

2 · The report he cites, named on screen

Still at 2:08:40 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Frontier-class hacking is now a free download. On September 29, Anthropic published its evaluation of GLM-5.3, an open-weight model that anyone can download and run.

• 86% performance compared to Mythos, on ExploitBench. Every earlier model, including Claude Opus 4.6, scored zero.
• 4 months behind the U.S. frontier, on NIST CAISI cyber benchmarks. The gap between gated frontier models and open source is measured in months.
• 100% of safeguards trivially bypassed, by crafting deceptive prompts, prefilling thinking tokens, and model abliteration.

Source: Anthropic, “GLM-5.3 and the spread of advanced cyber capabilities” (Sep 29, 2026); NIST CAISI benchmark assessment.

Still vs. transcript: aloud, Chow names neither the model nor the report; the slide names both. Its figures also differ from his paraphrase. Where he says “a couple months behind”, the slide says 4 months, as the report does. 86% is the ratio of the two ExploitBench success rates recorded under Debates (12% ÷ 14%), not a success rate. 100% is the top of the 64–100% range read in the report. Abliteration is the removal of a model’s refusal behaviour by editing its weights; Gemini read it as obliteration.

3 · The defender’s side, with a DARPA quote

Still at 2:08:59 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Adversaries already have frontier-class hacking tools. Our warfighters defend with bench rigs and checklists.

“AI will give defenders a much-needed edge in identifying and patching vulnerabilities at speed and scale.” (Stephen Winchell, DARPA Director)

Still vs. transcript: the headline is what he says aloud. The quote and its attribution are on the slide only, with no date or source. Not checked.

4 · GAO on weapon-system firmware

Still at 2:09:25 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Firmware is the soft underbelly.

Left, GAO, Weapon Systems Cybersecurity: “Nearly all” major weapon systems tested had mission-critical cyber vulnerabilities. GAO-19-128, systems under development 2012–2017. GAO-21-179 found cyber requirements still missing from many contracts.

Right:

• No antivirus, no patch Tuesday. Firmware talks straight to the hardware. The processor, operating system, and security mechanisms are a different domain.
• Decades-old weapons, often without source code. The prime holds the source code. Legacy fleets fly on code nobody has read in years.
• Tested by hand, one bench at a time. An expert cyber engineer, a bench rig, and 8–12 weeks per system. Limited by headcount, not by risk.

Sources: GAO-19-128 (Oct 2018); GAO-21-179 (Mar 2021).

Still vs. transcript: the narration gives the reasons in one sentence (“lack of updates, legacy code bases, lack of access, and … hardware in the loop”). The slide adds outside evidence, two GAO reports, and the talk’s only figure for today’s manual method: 8–12 weeks per system. The GAO reports date from 2018 and 2021. The next slide (2:09:41, not published) splits a platform into six firmware subsystems (flight controller, datalink radio, GPS/PNT receiver, seeker/sensor, actuator controllers, mission computer) on a platform bus of MIL-STD-1553, CAN, ARINC 429, UART and RF.

5 · RMF and ATO against what secures a platform

Still at 2:10:12 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Today’s DoW cyber requirements produce paperwork, not security.

What RMF / ATO asks for today	What actually secures a platform
Control checklists and STIG configuration reviews	Evidence from the system the prime delivered
Supplier questionnaires and attestations	Reproducible proof an adversary could get in
A point-in-time authorization	Every build, every update, every supplier change

Still vs. transcript: aloud, the objection is that RMF and ATO were written for enterprise IT (“there are no login pages for an aircraft or a munition”). The slide makes a second objection the narration does not: the requirements check documents and one moment in time, where the slide asks for evidence from the delivered system, tested again on every build, update and supplier change.

6 · From offense to defense

Still at 2:10:51 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Metalware started on offense.

2023 → 2025	2025 → today
Building bespoke offensive cyber with the U.S. Intelligence Community. Reverse engineering and vulnerability research on embedded systems.	Automating the workflow to defend every platform. Havoc, our platform, runs autonomously against firmware to find vulnerabilities across the whole fleet.
First, we learned how to attack mission-critical systems.	Now, we’re turning those tactics, techniques, and procedures (TTPs) into automated defense for the DoW.

Still vs. transcript: the narration tells the same story without dates or a product name. The slide dates the turn to defense to 2025 and names the platform, Havoc. The next slide (2:11:09, not published) gives Havoc’s four steps: scan the uploaded binary, build a digital twin from it, attack the twin through CAN, 1553, UART and RF at “millions of tests/hour”, then prove and report. Under them sit the logos of AFRL, Arizona State University and the University of Georgia; the narration names only the Air Force Research Lab.

7 · Why not just point a frontier model at the firmware?

Still at 2:11:49 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Why not just point a frontier model at the firmware? Frontier models excel at source code they trained on: web apps, APIs, open-source code. Firmware is a different world.

• No source code. The government rarely has source. Havoc works from the software binary.
• Firmware isn’t on GitHub. Firmware was never public, so AI never trained on it.
• Bugs live in hardware. You have to run the system to find them. Havoc builds a digital twin in software.
• Validated proof, not guesses. Every finding is reproduced and validated on the digital twin.
• Deploys offline, on-site. On-premises or fully air-gapped, using the models the enclave approves.
• Built on open-source AI. Operate without dependence on frontier model labs or cloud providers.

Still vs. transcript: aloud there are three reasons: the adversary has the same models, the models “were not trained on this type of code”, and testing happens air-gapped. The slide has six. It adds working from the binary without source code, a digital twin in place of hardware in the loop, and validation of every finding on that twin. The first spoken reason, wanting something better than the adversary’s models, is not on it. The slide also says Havoc is built on open-source AI, which the narration does not mention; the slide at 2:08:40 (entry 2) presents an open-weight model as the adversary’s new capability. The training-data point is still asserted, not shown.

8 · What an analyst sees

Still at 2:12:08 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

What an analyst sees. A screenshot of Havoc’s results page for one firmware image. Header: Image portenta_02_03_25_STM32H747AII6_CM7.elf · Architecture ARMv7 (Cortex-M) · Chip STM32H743 · Defects 40 · Stage Stopped · Duration 2h 17m. Tabs: Security 8 · Reliability 32; Showing 8 of 8 defects. Summaries abridged; the small print is legible at full size.

Defect	Classification	Summary	Review status
USART2-ab28	Out-of-bounds Write	USART2 idle-delimited receive events bypass enqueue_packet’s header accounting; an attacker-controlled four-byte write beyond the active 256-byte SPI transmit buffer	Unreviewed
SPI3-08a6	Out-of-bounds Write; Null Pointer Dereference	an unchecked packet length field from SPI input; out-of-bounds write in HAL_SPI_TxRxCpltCallback corrupts global FDCAN peripheral handles	Unreviewed
SPI3-0de1	Remote Code Execution	SPI3 CAN transmit subpackets supply an unchecked 16-bit length to a 16-byte stack copy in fdcan_handler, overwriting the saved return address and redirecting execution	Unreviewed
FDCAN2-85c7	Out-of-bounds Write	sixteen queued FDCAN2 frames exploit a capacity check in enqueue_packet that omits a four-byte subpacket header; four attacker-controlled bytes past the 256-byte TX_Buffer_1	Unreviewed
SPI3-d1e3	Out-of-bounds Write	an unchecked SPI3 DMA frame length used as an offset from the 256-byte RX_Buffer_userspace; corrupts adjacent global RAM	Unreviewed
FDCAN1-fde1	Out-of-bounds Write	an FDCAN1 frame burst exploits the same missing header allowance in enqueue_packet; three bytes beyond the 256-byte TX_Buffer_1	Unreviewed
SPI3-3caf	Out-of-bounds Read	a missing bounds check on a user-controlled pin index in gpio_handler; out-of-bounds read, null pointer dereference in HAL_GPIO_ReadPin, crash	Unreviewed
SPI3-0915	Null Pointer Dereference	peripheral_invoke_callback calls into the PeriphCallbacks table without a null check; crash on unregistered peripheral identifiers	Unreviewed

Still vs. transcript: the narration says only “couple of the product screenshots here”. The screen shows one run’s output: an STM32 Cortex-M firmware image, 40 defects (8 security, 32 reliability), each security defect with a code-level summary, and all eight still Unreviewed. The image filename (Portenta, STM32H747) points to a commercial development board rather than a weapons component, and names a different chip from the Chip field (STM32H743). The slide does not say whether the target is real or a test build. The next slide (2:12:13, on screen for four seconds, not published) opens the USART2 finding and shows the recovered chip-and-peripheral diagram; only its captions are legible: “a plain-language root cause, the exact line of code, and the stack trace that reaches it”, and a digital twin recovered “from just the software binary”.

9 · Weeks of expert work, delivered overnight

Still at 2:12:41 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Weeks of expert work, delivered overnight. A two-bar chart: Manual expert, a bar across the slide, against With Metalware, a sliver: about 12–24 hours, automatically, per firmware image · versus 8–12 weeks by hand.

• 98% less calendar time per software
• 1M+ tests per hour
• ~90% less triage time

Still vs. transcript: the narration gives no figures; it says the platform “reduces the labor and expertise required”. These are the talk’s only performance numbers, and the slide gives no method, sample or source for them. The 98% agrees with its own bar labels: 12–24 hours is 1–2% of 8–12 weeks.

10 · Customers, funding and contract vehicles

Still at 2:13:01 from YC Root Access, “The Startup Industrial Base: Building for the Next 250 — Washington, D.C.”.

Working across the national security enterprise.

• Intelligence Community: vulnerability research and reverse engineering on embedded targets
• Air Force: AFRL research on automated vulnerability detection; engagements with acquisition and cyber test units
• Defense primes: software assurance and supply chain firmware assessment
• Critical infrastructure: ICS, SCADA, operational technology, and more

$8M raised from Y Combinator, General Catalyst, RSA Conference, and more · Top 10, RSA Conference 2025 startup competition · 4 vehicles: GSA MAS · ITES-SW2 · NASA SEWP · Platform One · 2023, founded by engineers from SpaceX and defense primes

Still vs. transcript: the four segments match the narration. The slide adds the funding, with Y Combinator, the event’s host, among the investors; a startup-competition placing; four procurement vehicles; and the founding year. The next slide (2:13:10, not published) names where the engineers come from (SpaceX, U.S. Army, Palo Alto Networks, L3Harris, Johns Hopkins Applied Physics Laboratory, Microsoft) and who the company works with (U.S. Air Force, AFRL, U.S. Intelligence Community). All self-reported.

Why this matters to the wiki

1. Mythos-class capability, now attributed to a downloadable model. Mythos already has a trail in the corpus. Jones, speaking on 1 May 2026, expected “an open-source version of Mythos that anyone can use” within six months to a year. Loukides’s May digest already noted, for April, that small open-weight models can match Mythos at vulnerability discovery. Grinstead used Mythos at Mozilla, and Sundararajan read its withholding as a test of who governs AI (recorded on Anthropic). This talk adds the claim that an Anthropic report now places Mythos-level capability in a model anyone can download. For open-source-ai that is a cyber datapoint on the page’s open-versus-closed safety question. For foundation-models it is a measure of open weights catching up on a specialised capability, with the gap given in months. The report itself is not a wiki source yet; Debates records what it says.

2. Where a frontier model stops. Chow’s answer to “why not just use these frontier models” names three gaps: the attacker has the same model, the training data has little embedded code, and the test environment has no AI access. Grinstead also says the model is not the whole method, and credits Mozilla’s harness and fuzzing infrastructure with about half the result. The two put the missing half in different places: Grinstead in the agent-harness and the verification signal, Chow in domain knowledge, hardware in the loop and deployment inside air-gapped networks. Chow offers no evidence for the training-data point; his slide restates it (“Firmware was never public, so AI never trained on it”) without a source.

3. An attack surface with no login page. attack-surface-management is written around assets an attacker can see from outside: servers, subdomains, certificates, login panels. Chow describes a surface outside that frame: hundreds of embedded computers per platform, firmware that is rarely updated, hardware needed for testing, and compliance standards written for enterprise IT. The page’s open debate on whether AI favours attacker or defender turns on how fast fixes ship. Alim makes that argument for large legacy software estates, and Cloudflare’s chart has time-to-exploit falling below a day. Firmware with a “lack of updates” is the slow end of that range. Chow gives no numbers for how slowly it is patched. His slides cite GAO’s finding that “nearly all” major weapon systems tested had mission-critical cyber vulnerabilities, and put manual testing at 8–12 weeks per system.

Dynamic capabilities. contextual/external-triggers: the whole pitch responds to a disruptive digital technology, AI vulnerability discovery, reaching adversaries through an openly downloadable model. contextual/internal-barriers: on the customer’s side, Chow names cyber requirements (RMF, ATO) built for enterprise IT that “do not apply and are outdated” for hardware, teams working from bench rigs and checklists, and air-gapped high-side environments where AI access has to be arranged before it can be used.

Linked entities and concepts

• Entities: Anthropic (Mythos and the report Chow cites), Y Combinator (YC Root Access is the channel and host).
• Sources: the event page, Jones 2026, Loukides, May 2026, Grinstead 2026, Alim 2026, and, without a typed edge, Cloudflare Investor Day 2026 (time-to-exploit) and Sundararajan 2026 (the Mythos restriction).
• Concepts: attack-surface-management (a surface outside its external-asset frame), open-source-ai (the open-versus-closed safety question, with a cyber datapoint), foundation-models (open weights catching up on a specialised capability), agent-harness (what besides the model a vulnerability-finding system needs).
• Dangling (single-source mention, deferred): Ryan Chow, Metalware, Air Force Research Lab, Department of War, RMF / ATO, Salt Typhoon / Volt Typhoon. Mythos is mentioned across several sources without an entity page.

Debates and supersession

• What the cited report says (checked against the post itself on 2026-10-03; the post is not ingested as a source). Chow names neither the report nor the model aloud. His slide at 2:08:40 names both (see Visual canon, entry 2): Anthropic’s post of 29 September 2026, GLM-5.3 and the spread of advanced cyber capabilities, which also fits “literally yesterday”. As read: the model is GLM-5.3, an open-weight model from Zhipu AI (Z.ai). On ExploitBench it built end-to-end exploits in 12% of attempts against Mythos Preview’s 14%, and on an internal binary-exploitation benchmark 4% against 6%. NIST’s CAISI found it “lags the US frontier by about four months” on an aggregate of its cyber benchmarks, with US models tested with safeguards disabled. Its safeguards were bypassed in 64–100% of Anthropic’s tests. Set against Chow’s paraphrase: “similar performance to Mythos” matches the two benchmark figures. “A couple months behind” is shorter than the report’s four; his own slide says four. The slide’s “86% performance compared to Mythos” is the ratio of the two ExploitBench rates (12% ÷ 14%), and its “100% of safeguards trivially bypassed” is the top of the 64–100% range. “Open source” is the report’s open-weight, the tier distinction open-source-ai draws. The report is Anthropic’s own assessment of a competitor’s model, and it argues for giving defenders wider access to Claude’s cyber capabilities. Ingest it as its own source before other pages cite its figures.
• When the change happened. Chow dates the commoditization to “the last few weeks”. Loukides’s digest already recorded open-weight models matching Mythos at vulnerability discovery in April. The two may measure different tasks: finding a vulnerability, or building a working exploit, which is what the Anthropic benchmarks measure. Not resolved here.
• Founder pitch. Six minutes, no live demo (“it’s not as flashy to have a demo up here”), and product screenshots on the slides (see Visual canon). The customer list (US intelligence community; beginning work with the Air Force and AFRL; defense primes; commercial critical infrastructure in operational technology and industrial control systems) and the AFRL research partnership are self-reported. The slides add $8M raised, with Y Combinator, the event’s host, among the investors; four contract vehicles; and Arizona State University and the University of Georgia beside AFRL. The point that frontier models “were not trained on this type of code” is asserted without evidence and is also the company’s differentiator. The narration gives no figures for vulnerabilities found, time saved or accuracy. The slides do: 12–24 hours per firmware image against 8–12 weeks by hand, 98% less calendar time, 1M+ tests per hour, ~90% less triage time, and a demo screen with 40 defects on one image. None comes with a method or a source, and all eight security findings on that screen are marked Unreviewed.
• Model or method. Grinstead reports that Mozilla’s harness finds bugs “even with many models, not the latest frontier ones”. Chow argues defenders need capability beyond frontier models. They concern different code (a browser with decades of fuzzing infrastructure, weapons firmware that needs hardware to test), so the corpus cannot yet say whether they conflict.
• Context not checked. Cyber as “the first warfighting domain”, with Venezuela and Salt Typhoon / Volt Typhoon as examples, is the speaker’s framing. Out of the wiki’s scope; not verified.

What was actually ingested

Chapter 2:07:14–2:13:46 of the livestream. Chow speaks until about 2:13:24; the rest is applause and the next segment’s microphone check. The source is YouTube’s auto-generated English caption track, held as raw ASR in the shared raw file. Quotes were corrected only for spelling (“Enthropic” → Anthropic, mythos → Mythos), hyphenation and punctuation; a repeated “if if if” and a false start (“automating that en in order”) were cut. Four sentence-final words (“frontier.”, “tools.”, “system.”, “platforms.”) are missing from the raw file, which drops one-word caption lines. They were restored from the same caption track (the VTT file the raw file was built from). The slides were seen through stills: a targeted Gemini search over the chapter cut sixteen, each was viewed and its reading corrected against the pixels, and ten are published under Visual canon; the figures and citations on them (Anthropic, GAO, DARPA) are transcribed, not checked. Not checked: Metalware’s customers, its AFRL partnership, its product claims, and the geopolitical examples. The Anthropic report was found and read on the web on 2026-10-03 to identify what Chow was citing. It is not a wiki source, and its figures above are as read, not verified against the full text.