WS2 - Reaching Mythos: Hands-On Vulnerability Discovery with Local AI Models

Instructed by:  John “clearbluejar” McIntosh

Level of Difficulty: Intermediate

Abstract:

Anthropic, April 2026: Claude Mythos Preview is "strikingly capable" at zero-day discovery. They chose not to release it.

AISLE, one week later: "The moat in AI cybersecurity is the system, not the model." They reproduced Mythos-class findings on FreeBSD with a 1,700-line scan.py and a commodity model for under $100.

This four-hour hands-on workshop is the local-hardware version of that argument. Two reproductions, two domains, one harness pattern.

Part I: point AISLE's open-source pipeline at a pre-patch FreeBSD checkout through a hosted local-AI inference endpoint and reproduce the 17-year-old CVE-2026-4747 that drove Mythos, for sub-dollar spend.

Part II: change domains. Drive Ghidra through MCP tool calls against unpatchable D-Link DNS-320L firmware. Validate CVE-2024-3273 with the advisory in hand, then rediscover it from a blank start once the harness moves enumeration into the driver.

What happens next is what you come to find out. Same hardware, same model, same harness, four hours later: can local AI extend the famous disclosure with bugs the original missed? Come see for yourself.

No GPU. No API. No cloud spend. The workshop hosts inference for the room.

Pre-Requisites:

·      Need to be able to run a provided docker container with VS Code.

·      Comfort with Ghidra at the "open a binary and read a function" level.

·      Familiarity with Python at the "read a driver script and edit a constant" level.

·      Basic understanding of iot vulnerability classes.

·      No prior LLM tool-calling experience required; a five-minute primer lands in the orientation block.

No prior pyghidra-mcp or  experience required.