A few weeks ago, Anthropic made an unusual decision. Instead of releasing its latest model, Mythos, to the public, it restricted access due to its potential for offensive use in cybersecurity. A small group of organizations, including Palo Alto Networks, received early access through a program called Project Glasswing. OpenAI followed a week later with a similar restriction on its GPT-5.4-Cyber model.
These aren't PR moves. They're warnings.
In this episode of Threat Vector Investigates, host Peter Havens sits down with Yoni Allon, VP of R&D and Head of Research for Cortex, to share what Palo Alto Networks actually found when it ran these models in testing. What Yoni describes isn't a future threat. It's a capability shift happening right now, and the window to get ahead of it is closing fast.
A Different Kind of Dangerous
Frontier cyber models aren't purpose-built attack tools. They're general-purpose coding models whose offensive potential is a byproduct of how deeply they understand code. That distinction matters because they will keep improving regardless of the security use case.
What Yoni observed in testing wasn't just speed, though the speed alone is striking. It was the chaining: the ability to connect low and medium severity vulnerabilities into critical exploit paths, including approaches no one had seen before.
Then came the detail that put everything in sharper focus. The model found vulnerabilities in the open source Linux kernel code. Scrutinized by elite security engineers for nearly three decades. It didn't outwork them. It analyzed code in a fundamentally different way than any human or prior tool ever has.
Six Months
That's Lee Klarich's assessment. Palo Alto Networks' Chief Product Officer believes comparable models will be commonplace within six months. Not eventually. Not in some distant threat horizon. Six months.
The implications for SOC teams are concrete: vulnerability volume accelerates, attack timelines compress, and supply chain risk expands in ways that bypass traditional perimeter defenses entirely. If your mean time to detect and respond isn't already in single digits, the math doesn't work in your favor.
What Cortex Found
Project Glasswing wasn't only about understanding the offensive threat. Palo Alto Networks ran these frontier models against Cortex’s own detection capabilities to find gaps before attackers could. Yoni walks through what that testing revealed, what held up, what needed tightening, and what the results mean for organizations running Cortex today.
The findings are specific, and they're worth watching for.
What You'll See in the Video
- What Palo Alto Networks observed firsthand through Project Glasswing
- Why the Linux kernel finding signals a fundamental shift in vulnerability discovery
- How attack timelines and supply chain risk change when attackers have this capability
- What Cortex's defensive testing revealed about detection coverage against frontier cyber-generated exploits
- The framework Yoni recommends for SOC leaders starting to build a response
Frontier cyber capabilities will not stay contained. Watch the full conversation to understand what that means for your SOC, and what to do about it.