Anthropic's Mythos set off a cybersecurity 'hysteria.' Experts say the threat was already here
Anthropic's Mythos triggered bank panic and talk of new regulation, yet experts say the AI-driven vulnerability hunt it promises has been possible for months with existing models.
Global banks, tech giants, and the Trump administration scrambled last month after Anthropic released Mythos, a model touted for unearthing thousands of previously unknown software flaws. The controlled rollout to Apple, Amazon, JPMorgan Chase, and Palo Alto Networks was meant to buy time. Instead it ignited hysteria over an imminent wave of AI-powered ransomware and breaches.
Yet cybersecurity professionals say the feared capability was already here. Ben Harris, CEO of watchTowr, told CNBC that industry players are reproducing Mythos results "through clever orchestration of public models" from Anthropic and OpenAI. Klaudia Kloc, CEO of Vidoc, confirmed her team found the same zero-days using older Anthropic and OpenAI models after splitting codebases and cross-checking outputs.
Anthropic itself does not dispute this. The company pointed to its February blog post in which the widely available Claude Opus 4.6 discovered more than 500 high-severity vulnerabilities in open-source software. CEO Dario Amodei acknowledged at a recent event that while Mythos scaled the numbers dramatically, "the trend wasn't new" and "we've been seeing warnings of this for a while."
What distinguishes Mythos, according to the company, is its ability to generate working exploits with minimal human input. But researchers note that hackers backed by North Korea, China, and Russia already possess these skills. Stanislav Fort of Aisle argued that "a thousand adequate detectives searching everywhere will find more bugs than one brilliant detective," showing that parallel use of cheaper models can replicate headline results.
The panic has real consequences. Jamie Dimon warned that AI first increases vulnerability volume before offering defense. Justin Herring, former New York financial regulator, called vulnerability management "the great Sisyphean task of cybersecurity," noting that discovery now outpaces patching by days or weeks. Harris described recent conversations with banks and insurers as pure "hysteria," even as patching lags and systems must be taken offline.
Limiting Mythos to a select group created "tiers of haves and have-nots," in the words of Tenzai CEO Pavel Gurvich, slowing independent verification and broader defensive innovation. While startups race to build fixes, the offense holds the early advantage and the barriers for cybercriminals have dropped. The real question is whether orchestrated older models, already in malicious hands, will overwhelm defenses long before regulated super-models arrive.
Original reporting: CNBC.
More in Business
- IMF Chief Warns of Economic Divergence and Debt Risks Amid Artificial Intelligence Boom
Kristalina Georgieva suggests that while AI could significantly boost global growth, it simultaneously threatens to widen inequality and exacerbate inflationary pressures and public debt burdens.
- California Limits Utility Profits and Expands Home Energy Role
Gov. Gavin Newsom signed laws capping utility returns on lower-risk projects and accelerating virtual power plant development.
- Lyft to Pay $272.5 Million in Record California Wage-Theft Settlement
Largest such settlement in state history resolves claims that Lyft misclassified drivers as independent contractors from 2016 to 2020, denying them core wage protections.