Keynote LeHack 2026 - No need to be a Mythos to do offensive security

 It was an honor to deliver the opening keynote at leHACK 2026, France’s biggest hacking conference.

My talk: “No need to be a Mythos to do offensive security.”

The backdrop: in April, Anthropic unveiled Mythos, an AI finding thousands of high-severity 0-days across every major OS and browser, with access restricted to ~40 vetted organizations. On June 12, a US export-control directive cut that access for all non-US nationals. 4 days from launch to lockout.

So the question I wanted to answer on stage: do you really need a classified frontier model to do serious offensive security in 2026?

I argued the opposite and the evidence backs it:

→ DARPA’s AIxCC proved it in 2025: systems beat models.
→ Open-weight models (Gemma 4, Qwen 3.6) now hit frontier-level orchestration scores, on hardware that fits on your desk.
→ When researchers ran public models through the same harnesses (curl, Cloudflare, Vidoc, Hacktron), they reproduced Mythos-class findings.

The moat didn’t disappear, it moved. From model access to the harness: validation, prioritization, remediation. And those building blocks are already in your hands.

I also used the stage to announce the MCP Security Hub, our open-source catalog of MCP servers for offensive security:
👉 https://github.com/FuzzingLabs/mcp-security-hub 

Slides are attached below. 👇

Huge thanks to the leHACK team for having me, and to everyone who came to talk afterward.

You don’t have to be a Mythos. You just have to keep building.