Tenable ran Claude Mythos Preview (Anthropic's frontier LLM) against their own code repositories for 30 days as part of Project Glasswing, building an agentic security harness around it. Key findings: the model can chain low-severity findings into proven, reproducible exploits — shifting code security from ranking suspicions to verifying real bugs. The harness (orchestration layer) is the durable asset, not the model itself. Costs were significant: ~$41,718 in compute for 71 runs across 37 repos, with cache writes dominating at 60% of spend. Three passes are recommended per service due to non-deterministic model behavior. Senior security expertise remains non-negotiable — the model multiplies expert productivity but cannot replace threat modeling judgment. Practical guidance covers harness design, triage gates (reachability, automatability, impact, crown jewels), and where not to start.
