Anthropic's Mythos set off a cybersecurity 'hysteria.' Experts say the threat was already here

Last month, global banks, tech giants, and government entities rushed to address the potential risks posed by Anthropic's AI model, Mythos. This model has reportedly identified thousands of previously unknown vulnerabilities within the software infrastructure worldwide. However, cybersecurity experts assert that the capabilities causing this alarm are not new. According to professionals in the field, including Ben Harris, CEO of watchTowr Labs, the vulnerabilities uncovered by Mythos could already be detected with existing models, including those from Anthropic and OpenAI. "What we're witnessing across the industry is that vulnerabilities found by Mythos can be replicated using public models through strategic orchestration," Harris stated. The release of Mythos has raised significant concerns among executives and policymakers about an impending wave of AI-driven cybercrime. In a bid to mitigate potential risks, Anthropic restricted access to its model to a select group of American companies, including tech powerhouses like Apple and Amazon. This move was made in response to growing fears that malicious actors might exploit the model's capabilities. The situation has prompted discussions within the Trump administration regarding potential regulatory measures for future AI models. In the wake of Mythos's launch, OpenAI's CEO, Sam Altman, unveiled GPT-5.5-Cyber, a model designed specifically for cybersecurity applications. OpenAI has begun providing limited access to this model for vetted cybersecurity teams, indicating a competitive landscape as both companies approach their much-anticipated IPOs. Anthropic CEO Dario Amodei emphasized the urgency of the situation, warning that the proliferation of vulnerabilities could lead to increased financial damage from cyberattacks affecting various sectors, including schools and hospitals. Despite the heightened focus on Mythos, experts like Klaudia Kloc, CEO of Vidoc, argue that the ability to detect software vulnerabilities at scale has existed for some time. Kloc explained that her team successfully reproduced vulnerabilities similar to those identified by Mythos using older models through a technique called orchestration, which involves breaking down code and cross-checking results. This approach has demonstrated that the tools already in use can detect significant vulnerabilities, challenging the notion that Mythos represents a groundbreaking shift. Other firms, such as AISLE, found that many of Mythos's reported vulnerabilities could also be uncovered using more accessible models, suggesting that collaboration and scale might be more critical than the latest technology. As AISLE's founder Stanislav Fort pointed out, a coordinated effort of many average models can yield better results than relying solely on a single advanced model. Anthropic has acknowledged that earlier models can identify vulnerabilities, warning that AI's capabilities in cybersecurity are rapidly evolving. At a recent event, Amodei confirmed that while Mythos has indeed found more vulnerabilities than earlier models, the trend itself is not unprecedented. However, what distinguishes Mythos is its ability to autonomously develop working exploits, a skill already possessed by many skilled hackers in countries like North Korea, China, and Russia. This raises alarms about the potential for a surge in cyberattacks as cybercriminals adapt to the new technologies. The cybersecurity industry is currently experiencing a wave of anxiety, with conversations among banks and regulators reflecting a sense of urgency. Harris described the atmosphere as one of "hysteria," emphasizing the difficulty of managing vulnerabilities when patching often lags behind the discovery of new flaws. In this climate, the disparity between those with access to advanced AI tools and those without could hinder the collective ability to enhance cybersecurity measures. Despite the initial advantages conferred by Mythos's limited release for patching vulnerabilities, many in the cybersecurity community feel excluded from the conversation, potentially stalling innovation in the sector. As the landscape evolves, startups and industry leaders are grappling with how best to navigate this new era of AI-driven threats and defenses.