AI security firm Depthfirst discovers critical internet vulnerabilities at 10x lower cost than Anthropic

Huo Xing Finance reports that on May 12, AI cybersecurity startup Depthfirst announced that its proprietary AI vulnerability discovery model identified multiple critical security vulnerabilities missed by Anthropic’s Mythos, claiming the overall cost is only one-tenth that of Mythos. Depthfirst CEO Qasim Mithani stated that by optimizing the model architecture for specific tasks, the company can accomplish work that would cost $10,000 with Mythos using just $1,000. Depthfirst also launched a new initiative called the “Open Defense Initiative,” offering a total of $5 million in credits to make its AI vulnerability detection tools available to enterprises and open-source developers for identifying code security issues. The article notes that one key vulnerability discovered by Depthfirst exists in NGINX, the world’s most widely used web server—a flaw that has persisted since 2008 and theoretically affects a vast number of websites globally. F5 Networks, responsible for maintaining NGINX, is expected to release a patch this week. Additionally, Depthfirst disclosed a critical vulnerability in the Linux system that could be exploited for remote code execution, which remains unpatched. Its model also identified multiple security issues in Google Chrome and the open-source multimedia framework FFmpeg, with the Chrome-related vulnerabilities already fixed by Google. The report highlights that as AI accelerates vulnerability discovery, the cybersecurity industry is entering an era of “simultaneous AI-driven offense and defense.” Previously, Anthropic revealed that its Claude model was used by a Chinese hacking group for cyberattacks, and Google warned this week that criminal groups have begun leveraging AI to develop “zero-day” exploit tools.