Anthropic's Claude Mythos enables rapid vulnerability discovery, raising cybersecurity risks
Anthropic's Claude Mythos Preview frontier AI model, tested with about 50 companies in April 2026, reportedly discovered vulnerabilities in major browsers and operating systems at unprecedented speed. Regulators in Singapore and the US raised concerns that the same capability enabling defenders to patch flaws could be misused by cyberthreat actors, particularly threatening complex banking and financial infrastructure.
What happened
Anthropic began testing its frontier AI model Claude Mythos Preview with about 50 companies in April 2026. The model reportedly demonstrated the ability to autonomously discover and exploit vulnerabilities across major operating systems and web browsers, including decades-old bugs in widely trusted systems.
Anthropic said the model has found vulnerabilities in every major browser and operating system. The White House summoned representatives from JPMorgan Chase, Goldman Sachs, Citigroup, Bank of America and Morgan Stanley on April 10 to discuss systems-level vulnerabilities surfaced by the frontier AI model.
Reported impact
The Cyber Security Agency of Singapore warned that frontier AI models can reduce the time taken to identify vulnerabilities and engineer exploits from months to hours. The agency stated that the same capability could be misused by cyberthreat actors to accelerate vulnerability exploitation and malicious capability development.
Banking and payments infrastructure creates a large attack surface where a single AI-found flaw could trigger widespread, cascading disruptions. Frontier AI capability has potentially accelerated the pace of cyber threats beyond what human experts can achieve in weeks or months.
Index analysis
The model's capability to analyse billions of lines of code and identify weaknesses at speeds outpacing manual review represents a significant shift in cybersecurity threat dynamics. While there are no indications that such capabilities are currently being misused, the technology democratizes advanced cyber capabilities and increases the scale and speed of potential attacks.
The risk is heightened in complex, interconnected legacy financial infrastructure that combines modern cloud-native systems with older mission-critical platforms, creating vast attack surfaces where AI-driven vulnerability discovery thrives.
Governance controls
The Cyber Security Agency of Singapore issued an advisory on April 15 recommending immediate mitigation measures including applying software patches for critical vulnerabilities, implementing multi-factor authentication, and reviewing user permissions. The agency advised companies to immediately patch critical vulnerabilities in internet-facing systems and strictly control access to internet-facing development and test environments.
The White House engaged major financial institutions to address systems-level vulnerabilities identified by the frontier AI model, indicating government-level concern about the risks to critical infrastructure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.