Anthropic says Mythos is too powerful to be made public. As a result, small models can also reproduce most of the achievements.

A security company called Aisle conducted an experiment: using small open-source models to reproduce the vulnerability discoveries publicly demonstrated in Mythos.
Anthropic's main reason for not releasing Mythos is "too dangerous, hackers could cause disasters if they get it." But if small models can do similar things, then the strategy of "not releasing" itself becomes untenable.
Aisle's exact words: models are just engines; the real attack/defense capabilities depend on the systems built around the models—toolchains, knowledge bases, execution environments.