The Cat and Mouse Game: The Best Way to Beat an LLM Is With... an LLM

Cybersecurity has always been a cat and mouse game. Attackers probe, defenders patch, and the cycle repeats. But every so often, a shift in technology compresses years of incremental change into a single moment. We are living through one of those moments right now.

In late March 2026, Anthropic released Claude Mythos Preview – and the vulnerability research landscape changed overnight.

What Just Happened

Claude Mythos autonomously discovered thousands of zero-day vulnerabilities across every major operating system, every major web browser, and a wide range of critical infrastructure software. Not theoretical weaknesses. Real, exploitable bugs – many of which had survived decades of expert human review.

A 27-year-old flaw in OpenBSD, one of the most security-hardened operating systems in existence. A 16-year-old vulnerability in FFmpeg's H.264 codec that fuzzers exercised five million times without triggering. A 17-year-old remote code execution vulnerability in FreeBSD's NFS server. When independent experts reviewed a sample of 198 vulnerability reports, they agreed with Claude's severity assessment 89% of the time – and 98% were within one severity level.

As of today, over 99% of the vulnerabilities Mythos identified have not yet been patched.

The mouse just got a lot faster. The question is whether defenders can keep up.

Two Vulnerabilities That Tell the Story

FreeBSD NFS: 17 Years Hidden, 7 Hours to Exploit

CVE-2026-4747 is a stack buffer overflow in FreeBSD's kgssapi.ko kernel module, which handles RPCSEC_GSS authentication for NFS. The vulnerability is structurally simple: a function copies an attacker-controlled credential body into a 128-byte stack buffer without checking the length. The XDR layer allows credentials up to 400 bytes, giving an attacker over 300 bytes of overflow.

This bug existed for 17 years. Countless security audits and code reviews missed it.

Claude Mythos found it, analyzed it, and then – with a single initial prompt and zero human guidance – autonomously built a working remote exploit. It constructed a 20-gadget ROP chain, split it across multiple NFS packets to bypass size constraints, and delivered a payload that grants full root access to any unauthenticated attacker on the network. The entire process, from discovery to working root shell, took approximately seven hours.

Linux Kernel: Chaining the Invisible

In the Linux kernel, Mythos demonstrated something arguably more alarming than finding a single bug: it found attack chains. Claude identified two to four individually low-severity vulnerabilities and composed them into full local privilege escalation – taking an ordinary user to complete root control.

The technique involved KASLR bypasses to defeat kernel address randomization, cross-cache heap reclamation to manipulate memory layout, and credential structure overwrites to elevate privileges. Each individual vulnerability, taken alone, would have been triaged as low-priority. No human reviewer connected the dots across these disparate code paths. The LLM did.

This is the real paradigm shift: not just finding bugs faster, but reasoning about how benign-looking weaknesses combine into critical attack paths.

How Defenders Can Respond: Behavioral Detection

If LLMs can discover and exploit vulnerabilities that survived decades of human scrutiny, static signatures and known-CVE matching are no longer sufficient. Defenders need detection strategies that reason about behavior – and LLMs are uniquely suited to power them.

Here are three concrete approaches, grounded in the log sources that security teams already collect:

Detecting NFS Exploitation (Post-Compromise)

The FreeBSD NFS exploit ends with the NFS daemon spawning a shell. This is a behavioral anomaly that no legitimate NFS operation produces. In endpoint audit logs, defenders should monitor for process creation events where the parent process is nfsd or rpc.gssd and the child process is an interactive shell (/bin/sh, /bin/csh) or a network utility. A legitimate NFS server should never fork a shell – full stop.

On the network side, firewall and VPC flow logs can detect the temporal correlation between an inbound connection to NFS port 2049 from an external or unexpected source IP, followed shortly by an outbound reverse-shell connection from the same host. Neither event alone is conclusive. Together, they are a high-confidence exploitation indicator.

Detecting Kernel Privilege Escalation Chains

The Linux kernel exploit chain leaves traces in audit logs: an unprivileged process (uid != 0) suddenly gaining root (uid = 0) without traversing a legitimate escalation path like sudo or su. Monitoring setuid/setgid syscall records for processes with no authorized escalation context is the key behavioral signal.

EDR platforms can complement this by detecting the exploitation fingerprint itself: rapid successive mmap/mprotect calls making memory regions executable, combined with reads to /proc/kallsyms (KASLR bypass probing). Individually, each of these signals is low-severity. An LLM-powered detection engine correlates them into a high-confidence escalation alert – the same way Claude chained low-severity bugs into a critical exploit, but in reverse, for defense.

Cross-Source Correlation: Where LLM Detection Shines

This is where the defensive LLM advantage becomes decisive. Traditional SIEM rules operate on a single log source: one rule, one pattern, one alert. But real exploitation chains span multiple layers – network, endpoint, and application.

An LLM-powered detection system can correlate a network anomaly (an unusual authentication exchange pattern on a service port, visible in firewall logs) with an endpoint anomaly (unexpected process lineage from a service daemon, visible in audit logs) and an EDR finding (memory manipulation or privilege change). No single log source raises a critical alert. The LLM reasons across all three simultaneously and identifies an active exploitation chain in real time. This is exactly the kind of detection that signature-based systems structurally cannot produce.

The Path Forward

The vulnerability research field has taken a great leap. Claude Mythos found bugs that survived 27 years of human review and composed attack chains that no individual researcher connected. This is not a temporary spike – it is a permanent expansion of the threat surface. Every piece of software now faces a level of scrutiny it was never designed to withstand.

Traditional detection, built on known signatures and static rules, cannot keep pace with AI-accelerated vulnerability discovery. When the attack surface expands exponentially, the defense must scale the same way.

The best way to counter an LLM-powered offense is with LLM-powered defense: behavioral detection that reasons about patterns rather than matching strings, that correlates weak signals across data sources rather than alerting on single indicators, and that adapts to novel attack techniques in real time rather than waiting for a signature update.

The cat and mouse game hasn't ended. But the rules have changed. In our dynamic world, the defenders who harness the same AI capabilities now being used to break systems will be the ones who succeed in protecting them. The same technology that empowers attackers can now equip defenders – and in cybersecurity, it's time for the mouse to become the cat.