Will Cybercriminals Use Mythos-Class Models Against Black-Box Web Applications?

Yes. Source-code access makes vulnerability research easier, but it is not required. A sufficiently capable agent can learn a great deal from the behavior an application exposes over the internet.