Refuted by Default: Dragos' Methodology for AI-Driven Vulnerability Detection in OT Security Software
Summary: Dragos joined Project Glasswing to run Anthropic's Claude Mythos Preview against its own OT security software, building a pipeline in which 60 to 90 percent of raw vulnerability candidates are killed before an engineer sees them. The pipeline runs findings through hunt, refute, prove, and judge stages, with the refute validator shown only a bare claim and defaulting to refuted when uncertain, and proof requiring a proof of concept that reproduces three times from clean state.
Bottom line: One run spent 68.7 million tokens across 748 agents and confirmed nothing because the test identity could not reach the code under test; with the fixture corrected, a re-run confirmed 12 findings, four critical, for 3.7 million tokens. The pipeline also refuted an XXE entry in Dragos's own ground-truth document by executing entity expansion payloads against the pinned parser, which disables entity expansion by default.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026