# System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models

DevFeed: [System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models](<https://devfeed.tech/articles/system-over-model-tested-reproducing-mythos-s-freebsd-find-on-local-open-weight-models-39721.md>)

Original publisher: [Read original article](<https://clearbluejar.github.io/posts/system-over-model-tested-mythos-freebsd-local-openweight/>)

Author: clearbluejar

Published: 2026-06-04T07:00:00Z

Content type: article

Language: en

Sources: [clearbluejar](<https://devfeed.tech/sources/clearbluejar.md>)

Topics: [freebsd](<https://devfeed.tech/topics/freebsd.md>), [gpt-oss](<https://devfeed.tech/topics/gpt-oss.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [gemma4](<https://devfeed.tech/topics/gemma4.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Benchmark](<https://devfeed.tech/topics/benchmark.md>), [Python](<https://devfeed.tech/topics/python.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [benchmark](<https://devfeed.tech/tags/benchmark.md>), [cve](<https://devfeed.tech/tags/cve.md>), [false-positives](<https://devfeed.tech/tags/false-positives.md>), [freebsd](<https://devfeed.tech/tags/freebsd.md>), [gemma-4](<https://devfeed.tech/tags/gemma-4.md>), [gpt-oss](<https://devfeed.tech/tags/gpt-oss.md>), [llm](<https://devfeed.tech/tags/llm.md>), [llms](<https://devfeed.tech/tags/llms.md>), [python](<https://devfeed.tech/tags/python.md>), [rce](<https://devfeed.tech/tags/rce.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

## AI overview

This article tests AISLE's vulnerability-finding pipeline on the local open-weight models gpt-oss-20b and gemma-4-31b-it using a FreeBSD RCE as the benchmark. The models initially appeared to miss the bug, but a rerun recovered it. The author reports that adding a reachability stage reduced false positives from 30 to 5 while retaining the CVE finding.

## Source excerpt

Mythos found a 17-year-old FreeBSD RCE; AISLE reproduced it with gpt-5.4-nano via their nano-analyzer pipeline. I ran the pipeline on two local open-weight models, gpt-oss-20b and gemma-4-31b-it. The misses recovered on re-run. The real problem was the false-positive rate, and one extra system stage cut it from 30 to 5 with the CVE still standing.