Nathan Lambert Revisits His Open-Weight Mythos Take: Is "Fine" the Right Word?

Nathan Lambert, the researcher behind the Interconnects newsletter, published a follow-up on October 30, 2026 to a take that drew heavy criticism: that an open-weight release of Claude Mythos "would've been fine." His answer to the pushback is nuanced. He keeps the core claim, that recent events look like an acceleration rather than a step change, but says the word "fine" undersells what is coming. The post is titled "Was I wrong about open models & cyber risks?".

This is an opinion piece, not a measurement, so we treat it as one. But it lands in the middle of the month people are calling "Black October," and the argument it makes is one many builders and security teams are actively weighing.

TL;DR

Agents that act on your behalf need rules. See how explainx helps secure your agents →

The setting: Black October

Lambert opens by saying the previous week coined the term "Black October" after an onslaught of critical vulnerability disclosures, including PHP2Shell and GitLab, which signified "the moment when the cyber risks of AI models started to materialize." We covered the PHP side in PHP2Shell explained simply, where an AI-found bug forced emergency patches. He also mentions another major crypto security incident at Binance, and notes the crypto industry has a long hacking history, so it is a poor industry for judging whether vulnerabilities create new societal harm.

He adds that, per the Wall Street Journal, cyber first responders are strained, which he reads as "the system working." His best guess is that behind-the-scenes work has accelerated and more people and resources are being brought in to patch the internet, while we live through an exponential rise in vulnerabilities that will take a long time to level off.

What the original claim said

A gear with a green bandage over a crack, representing emergency security patches in the open-weight cyber risk debate

The earlier take, quoted in the new post, argued that when Claude Mythos was announced it was previewed as a new class of cyber weapon that would cause mass destabilization in the wrong hands. Lambert wrote that this "seems to have been wrong." In his view, GLM-5.3 is the model that crosses the capability threshold, and over a month after its weights were released there is little public evidence that much has changed. He went further: if Mythos had been accidentally released as open weights, the world would have been fine in the sense of an acceleration, with a clear increase in incidents but not a step change.

He framed critics as having made a falsifiable prediction, that current open-weight models would cause unprecedented AI harms by crippling cyber infrastructure, and said that on his evidence they were "set up to be wrong." Now, he writes, after years of debate, "we will start to get some real answers."

For the background on those models, see Anthropic's own Frontier Red Team write-up on GLM-5.3 and the spread of advanced cyber capabilities and our coverage of that report and the original Claude Mythos Preview and Project Glasswing announcement.

The receipts on how the fear was voiced

To check whether he had misremembered the tone of the debate, Lambert went looking for examples of language he found exaggerated. He lists three:

• Rob Wiblin, host of the 80,000 Hours podcast, on April 10, 2026: "If it fell into the hands of criminals or hostile state cyber actors, it would be an actual disaster."
• Anthropic's Project Glasswing announcement on April 7, 2026: such capabilities will proliferate, and "the fallout for economies, public safety, and national security could be severe."
• Zvi Mowshowitz on April 9, 2026, whom he calls a more reasonable example: Mythos "would give attackers a cornucopia of zero-day exploits for essentially all the software on Earth … It would be chaos."

He acknowledges the criticism that nobody in the frontier community said it would be a "true disaster," but argues that what matters is how the message is heard and internalized, and that this impression spilled into the public and federal government view of the model as a cyber weapon. Of Mowshowitz's line he adds that, to date, the chaos "has been confined to those running large-scale digital products, which is good, but could change."

What he softens

The most interesting part is the retreat on one word. He writes that he should have been more specific about what "fine" means, and that giving "more credit to some of the AI safety community that discussed this reasonably as a new era in cyber instability" would have been fairer. He is "not sure fine is the right word" for what is coming: "a forced industry update to a new way of working with software, which will clearly be expensive and accompanied by some hard work."

His rule of thumb: if you were already somber about AI's challenges, "fine" fits. If you had not priced in a period of turbulence, "fine" undersells it. He puts himself in the first group, and still expects people to muddle through and patch immediate concerns.

The evidence he leans on

A box opening as green seeds drift out toward open hands, symbolizing open-weight model releases and the cyber risk debate

Epoch AI's GLM-5.3 work. He highlights Epoch's internal use of GLM-5.3 to find vulnerabilities and chain them. The quoted result: a website that, merely visited by a Firefox user and with no further interaction, let an attacker exfiltrate files from the computer. His read is that this shows why cyber risk needs several things to line up: the attacker still has to plant a site that looks for the flaw, so finding the exploit is one step of a multi-stage process. Our own write-up of that research is Epoch's Firefox patch-gap exploits.

Threat-actor economics. He quotes a social post arguing threat actors behave like businesses: "A bakery isn't going to start making dog food because there's a dog food shortage." Phishing and ClickFix actors will not drop everything to vibe-code exploits because a critical CVE appeared. We cannot verify who is behind that quote beyond how Lambert presents it.

Ecosystem trend lines. He cites cybersecurity commentators Joshua Saxe and Chris Hughes for the point that exploits and damages have been growing since long before ChatGPT, and that recent events are on an exponential trend. If AI capability and diffusion were the bottleneck, he says, the plot would look like a step change instead.

Open versus closed: who is finding the bugs?

Lambert argues the real driver is AI capability and diffusion in general, not open versus closed. His claims on the open-closed split:

• He expects most of the vulnerabilities are being found by closed models, "but I have very high error bars on this prediction."
• Closed models have played a very heavy part in recent hacks, more than open models.
• Open models are expensive to serve and the compute for the largest is sold out. If an open model were used in a hack soon, he suspects it would be through a poorly secured open-model API.
• Long term, he is confident that open-model margins and prices will fall as compute supply grows, which he wants to happen so that a few companies do not both build the tools that produce software full of vulnerabilities and sell the tools that fix them.
• He believes open models give balance in the offense-defense equation and that companies would adopt open-weight models faster than attackers, since most attackers are lower resourced.

A reader comment on the post from Chris Hughes adds a counterpoint worth noting: most published research, from frontier labs and external groups like Epoch and Irregular, focuses on offensive capabilities, with far less on defensive ones. Hughes lists reasons, including that offense is more verifiable than defense and that defensive research would expose how often legitimate users hit refusals on closed models. That is a commenter's view, not a finding.

How to read this, honestly

A few cautions are due.

• It is a forecast. Lambert says plainly he is not a cyber expert and is making the most educated predictions he can, calling the line between "tech companies need to work harder" and "public infrastructure is going down" a fine one.
• A month is a short sample. The argument rests partly on absence of public evidence of mass harm after GLM-5.3's release. Absence of public evidence is not absence of harm, and he concedes adversaries have likely used these models to extract information en masse in a clandestine way.
• The attributions are contested. Others, including the sources in our coverage of Anthropic's cyber verification program and OpenAI's CFO on Chinese models and cyber risk, argue differently about what open weights change.
• Who is writing. Lambert advocates for open models and recently announced his own lab, which we covered in Trillium Labs. That does not make him wrong, but it is context for how to weigh the argument.

What to do now, whichever side you take

The practical advice does not depend on who wins the debate:

1. Shorten patch time. If vulnerabilities arrive faster, the window between disclosure and your fix is the number to cut. Automate dependency and runtime updates.
2. Assume agents are targets and tools. AI coding agents can both find bugs and be abused. AgentBeam, the agent security platform from the explainx.ai team, covers detecting and blocking risky agent actions, and its write-up of the open-weight Firefox patch-gap exploits is the closest companion to this debate.
3. Watch the weakest link. Per Lambert's own point about poorly secured model APIs, secure any inference endpoint you expose.
4. Track evidence, not vibes. Follow ecosystem-level data such as disclosure volume and time to exploit rather than single incidents.

Related reading

• PHP2Shell explained simply
• Anthropic on GLM-5.3 cyber capabilities and open weights
• Claude Mythos Preview and Project Glasswing
• Epoch: Firefox patch-gap exploits with an open-weight model
• Anthropic cyber verification program
• Trillium Labs launch by Nathan Lambert

Quotes and positions are from Nathan Lambert's October 30, 2026 Interconnects post and may be revised as new incidents emerge.