BT explainer: Inside Claude Mythos, the AI is forcing a rethink of global cybersecurity

Anthropic's latest AI model, Claude Mythos, is causing significant concern within government and cybersecurity sectors, not just due to its capabilities but also because of its rapid operational speed. Designed to autonomously discover and exploit security flaws, this model is prompting a reevaluation of existing cyber defenses in an increasingly AI-driven threat landscape. Introduced on April 7, Mythos stands out from its predecessors by eliciting more alarm than intrigue. High-level discussions are taking place across the US, UK, Canada, and India to evaluate the risks associated with such advanced AI systems. In India, Finance Minister Nirmala Sitharaman recently convened a meeting with banking leaders and industry stakeholders to assess the emerging threats posed by advanced AI technologies like Mythos. The pressing question for authorities is why they are so alarmed. To understand the gravity of the situation, it is crucial to explore Mythos's functionalities and the reasons behind Anthropic's cautious rollout. Claude Mythos is engineered with a strong emphasis on cybersecurity, autonomous coding, and long-term AI operations. According to Anthropic, the model excels at detecting, rectifying, and even exploiting software vulnerabilities, which has raised serious concerns among decision-makers. In initial tests, Mythos uncovered a 27-year-old vulnerability in OpenBSD that could enable attackers to crash systems remotely, as well as a 16-year-old flaw in the widely-used FFmpeg video-processing tool. Remarkably, these vulnerabilities were identified without any human assistance. In a statement, Anthropic revealed that Mythos Preview has already detected thousands of high-severity vulnerabilities, impacting every major operating system and web browser. They warned that, given the pace of AI advancement, it won’t be long before such capabilities become widely accessible, potentially falling into the hands of individuals who may not prioritize safety. While previous models like Claude Opus 4.6 had a minimal success rate in developing autonomous exploits, Mythos Preview has shown marked improvement. Even engineers at Anthropic, lacking formal cybersecurity training, were able to use Mythos Preview to pinpoint critical system vulnerabilities and create effective exploits in a single night. These functionalities emerged as the model advanced in coding, reasoning, and autonomy, rather than being explicitly programmed. Although these advancements can aid in remedying security weaknesses, they also facilitate exploitation. Due to this dual-use risk, Mythos Preview is being released to a select group of around 40 companies and institutions as part of Project Glasswing, which includes major players like Amazon Web Services, Apple, Cisco, CrowdStrike, Google, Microsoft, and NVIDIA. The emergence of Claude Mythos has ignited discussions among policymakers and industry experts regarding the potential overstatement of risks. Some analysts suggest that powerful AI systems such as Mythos could enable more aggressive and large-scale cyberattacks, compelling enterprises and financial institutions to urgently bolster their defenses. Conversely, Sam Altman has criticized the limited rollout, branding it as “fear-based marketing.” Speaking on the Core Memory podcast, he remarked that certain individuals have long sought to keep AI technology restricted to a select few. Ciaran Martin, a cybersecurity expert, expressed caution, stating, “We cannot definitively say whether Mythos Preview would be capable of breaching well-defended systems.” He noted that opinions on this matter vary widely, with some viewing it as an impending disaster while others see it as exaggerated hype. Experts like Prabhu Ram, VP at CyberMedia Research, emphasize the urgent need to rethink cybersecurity strategies in light of Mythos's capabilities. He warned that advanced AI models like Claude Mythos lower the barrier for executing complex cyber intrusions, enabling adversaries to operate at speeds and scales previously reserved for well-funded nation-state actors. Security gaps that once allowed organizations days or weeks to respond now present challenges in mere hours or minutes, turning the response window into a race that many enterprise security teams are unprepared for. The consensus among experts is clear: while such AI systems do not create new vulnerabilities, they unveil existing ones with unprecedented efficiency. As Ram articulated, the critical divide lies between organizations that have invested in foundational security measures and those that have not; the latter will find themselves at the mercy of advanced AI that can exploit weaknesses far faster than any human adversary could.