But I don't need to test that; we all know it's possible. Known vulnerabilities are in the training set!

Mythos is being claimed to have new abilities, right? What would testing the old model on a different use case do?

You’re conflating types of vulnerabilities with the vulnerability itself. Take CVE-2026-4747 which was supposedly found by mythos. The actual issue here is a stack overflow. Opus can find those.