Startup Depthfirst AI Model Finds Vulnerabilities Missed by Anthropic Mythos

Cybersecurity startup Depthfirst stated that its AI model discovered critical vulnerabilities in tools that support much of the internet. The company said the model identified flaws that Anthropic's Mythos model had missed and completed the work for one-tenth the cost.

Depthfirst CEO Qasim Mithani said the company optimizes its models for a single task. He stated that this approach allows Depthfirst to deliver results for $1,000 that Mythos produces for $10,000.

Depthfirst raised $80 million at a $580 million valuation in March. The company is launching the Open Defense Initiative, which will provide $5 million in credits to companies and open-source developers for using its AI to scan code. Mithani said the program will review applicants and initially limit access to open-source developers whose code is widely used or deployed in critical infrastructure.

He stated that restricting the technology to select partners is not the right approach.

Depthfirst reported a vulnerability in NGINX that had existed since 2008. The flaw affects the web server used by nearly two-thirds of the most visited sites on the internet. F5 Networks, which maintains NGINX, is scheduled to release a patch later this week.

The model also identified a flaw in the Linux operating system that could allow unauthorized code execution. The Linux Foundation had not responded to requests for comment at the time of reporting. Depthfirst found two high-severity bugs in Google's Chrome browser.

Google confirmed the findings and stated that both issues have been patched. The model discovered 12 previously unreported flaws in FFmpeg, software used by Netflix, YouTube, Instagram, Facebook, and Spotify. Jean-Baptiste Kempf, an FFmpeg maintainer, said finding vulnerabilities is easy but fixing them correctly is hard.