BT explainer: Why Anthropic’s Claude Mythos could become a major security risk?

Anthropic, a prominent AI firm based in the United States, has recently unveiled its innovative AI model, Claude Mythos, which entered preview stage in April. This advanced system boasts impressive cybersecurity features, allowing it to autonomously analyze codebases and detect 'Zero-day' vulnerabilities. While this capability has the potential to significantly bolster critical software systems against fraud, it has also sparked serious concerns regarding its possible misuse. Due to its advanced functionalities, access to Mythos has been tightly controlled, restricted to approximately 40 technology and banking partners through an initiative known as 'Project Glasswing'. Major players in this consortium include Amazon Web Services (AWS), Apple, Google, Microsoft, and NVIDIA, among others. Additionally, the U.S. National Security Agency (NSA) is also granted access, raising eyebrows given the existing government restrictions and supply-chain risk assessments from the Department of Defense. What exactly is Claude Mythos? According to information shared by Anthropic, this AI model is designed for general use with enhanced coding and reasoning capabilities. It reportedly surpasses earlier models like Claude Opus 4.6 in terms of performance. During initial testing, Mythos was able to uncover a 27-year-old vulnerability in OpenBSD that could allow hackers to crash systems remotely, as well as a 16-year-old bug in the widely utilized video processing software FFmpeg. These discoveries were made autonomously, showcasing the model's unique competencies in the AI landscape. Despite the promising applications, there are growing apprehensions from government officials and cybersecurity experts about the potential for misuse. Reports indicate that powerful AI models like Claude Mythos could be co-opted for malicious purposes if they fall into the wrong hands, leading to aggressive and destructive cyberattacks. Anthropic has noted that Mythos has already identified thousands of high-severity vulnerabilities across major operating systems and web browsers. With the rapid advancement of AI technology, there are fears that such capabilities could soon be accessible to bad actors. In the UK, financial regulatory bodies including the Bank of England and the Financial Conduct Authority are actively engaging with the National Cyber Security Centre to evaluate the threats posed by Mythos to critical financial systems. Similarly, U.S. Treasury Secretary Scott Bessen convened a meeting with Wall Street executives to alert them to the cybersecurity risks associated with the AI model. Furthermore, discussions between the White House and Anthropic's CEO, Dario Amodei, have focused on ensuring that AI innovation is balanced with necessary safety measures. As a result, the public release of Claude Mythos will be contingent on thorough safety evaluations and cybersecurity testing under Project Glasswing, highlighting the ongoing tension between the potential benefits and risks of advanced AI technologies.