
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Analysis
This article is for owners and management boards of software houses and IT services companies. Clients ask how your team uses AI and increasingly expect a lower price because of it. We look at what research says about how much faster developers work, how this affects billing and contracts, and how to measure the effect in your own team.

There is no single answer to how much faster developers become. The result depends on the type of task, the developer’s experience and how well the tool knows the project. The table below compares three frequently cited studies that show this spread well.
The GitHub experiment involved one simple task written from scratch. The METR study covered experienced developers working on large projects they had known for years. In the second case, AI got in the way more than it helped, although participants were convinced of the opposite.
METR points out that its results relate to tools from early 2025, and in 2026 it described them as out of date itself. The lesson still matters, though: the team’s perception and the measurements can diverge sharply. That is why a claim like “we are twice as fast” has to be checked against the numbers.
The authors of the DORA report describe AI as an amplifier. In companies with well-organised processes it speeds up work; in chaotic companies it exposes their weaknesses faster.
| Study | Who took part and what they did | Result |
|---|---|---|
| GitHub and Microsoft Research, 2023 | Developers writing a simple HTTP server in JavaScript from scratch | The group using GitHub Copilot finished the task 55.8% faster |
| METR, 2025 | 16 experienced developers, 246 tasks in their own large projects | Work took 19% longer with AI; participants believed they had sped up by 20% |
| DORA 2025 (Google), survey | Nearly 5,000 IT professionals from many countries | About 90% use AI; productivity gains are mainly respondents’ own assessment |
You gain most on repetitive, well-defined work. Risk grows where mistakes are costly and hard to spot. The list below orders typical tasks from the safest to the most demanding.
The 2025 Stack Overflow survey puts its finger on the main problem. Developers complained most often not about code that was completely wrong, but about code that was “almost right”. Such code passes a cursory check, and the defect may only surface after the software has been handed over to the client.

With time-and-materials billing, where you charge for hours worked, every hour saved reduces your revenue. Clients know this and increasingly ask why the rate has not changed if the team uses AI.
You do not have to abandon hourly billing straight away. It is worth, however, choosing the model deliberately to suit the type of work. The table below shows who benefits from the speed-up in each of three common models.
A fixed price only makes sense if you can estimate AI-assisted work well. Without a few months of measurements on your own projects, it is easy to end up with a quote in which the unknowns eat up the entire gain from AI.
| Model | Who gains from AI | Risk for the IT company | When it fits |
|---|---|---|---|
| Time and materials (hours) | Mainly the client – it pays for fewer hours | Lower revenue with the same team | Unclear scope, maintenance, supporting the client’s team |
| Fixed price for a defined scope | The IT company, if it estimated the work well | Wrong estimates and disputes over scope changes | Well-defined projects and repeatable types of implementation |
| Outcome-based fee or fixed subscription | Both sides, if the outcome measure is fair | Difficulty agreeing the measure and disputes over measuring it | Long-term collaboration on product development and maintenance |
Preparing a proposal often takes several days of work from the most experienced people in the company. AI can shorten this work, but it will not take over responsibility for the estimate.
It works best with your own material. The company collects data from completed projects: scope, estimate, actual time and problems encountered. AI compares a new request with this database and prepares a draft, which the architect then corrects.
Be wary of estimates that AI produces without data from your projects. They sound convincing, but they are based on general patterns, not on how your team works. Below are the tasks in which AI works best for proposals.

Clients do not pay for lines of code; they pay for working software. AI changes the cost of producing it, but it does not take away your responsibility for the result.
Many IT company owners are wondering whether to rebuild their offering around AI. This is a decision about the team, sales and risk, not just about a slogan on the website.
A generalist company can use AI mainly to cut its own costs without selling it as a separate service. An AI implementation specialist competes on expertise, but it needs experienced people and operates in a narrower market.
Many companies take a middle path: they keep their existing offering and set up a small team for AI projects. What matters is that this team has real projects, not just an entry in the service catalogue.
| Direction | What it means | What it requires | Main risk |
|---|---|---|---|
| Generalist with AI inside | AI lowers the team’s cost of work; the offering stays the same | Rules for using tools and measuring the effect | Price pressure from clients and cheaper competitors |
| AI implementation specialist | AI as the main service: chatbots, AI agents, document analysis | People with experience in AI projects and knowledge of the regulations | A narrower market and fast-changing tools |
| Middle path | Existing offering plus a small team for AI projects | A clear division of roles and the first successful projects | An AI team with no projects that exists only in the sales offering |
Clients increasingly raise AI as early as the contract negotiations. They want to know whether their code will go to external services, who is liable for errors and who owns the rights to the code.
Copyright needs particular attention. Polish copyright law protects works that result from creative activity, and the prevailing view is that this means human creativity. Code generated entirely by AI may therefore not be a protected work, so it is worth agreeing the contract wording with a lawyer.
If you are building an AI system for a client, such as a chatbot, agree who is its provider within the meaning of the AI Act. Usually it is the company under whose name the system is put into use – sometimes you, sometimes the client. The provider is responsible for, among other things, the obligation in Article 50: the system must tell people they are interacting with AI. Below are the points worth discussing with the client before signing the contract.
Before you change your price list or promise a client a shorter deadline, measure the effect on your own projects. A few metrics are enough, and most teams already collect them in their task system, e.g. Jira.
Compare the periods before and after introducing the tools, ideally on similar projects. The number of lines of code tells you nothing here, because AI inflates it easily while quality may drop.
Measurement also reveals hidden costs. If tasks finish faster but the number of bugs reported by the client rises, the gain is illusory. The metrics below show both of these effects.
Introducing AI in an IT company is best run like any other project: with a goal, measurement and a decision after the pilot. The steps below show a sensible order.
Clients ask how you yourself use AI. The best answer is written rules and figures from your own team, not general statements in a proposal.
Related topics in the knowledge base
FAQ
The questions IT company owners ask most often when they start bringing order to how AI is used.
About this page
Sources
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation, we will help you set rules for using AI on client projects and choose the metrics you will use to check the effect in your own team.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.