Anthropic's Mythos AI discovers thousands of zero-day vulnerabilities
Anthropic's Claude Mythos AI system discovered thousands of previously unknown zero-day vulnerabilities in major operating systems, web browsers, and other software during testing. The system can automatically identify and exploit security flaws, raising concerns about misuse despite Anthropic's controls limiting access to the model.
What happened
Anthropic developed Claude Mythos, an AI system that can automatically detect zero-day vulnerabilities in open-source code and proprietary software by analyzing code, identifying bugs, confirming them through execution, and generating exploitation reports.
During initial testing, Mythos identified several thousand high-severity and critical vulnerabilities affecting major operating systems and web browsers, which were validated by expert reviewers who confirmed the severity in 89% of 198 examined reports.
Reported impact
Mozilla discovered 270 security vulnerabilities in Firefox using Mythos, compared to 22 found with the previous Claude Opus 4.7 model, which were fixed in Firefox update 150.
Mythos can identify logic errors, authentication bypasses, and implementation errors in cryptographic libraries, putting systems used by banks and medical data storage at potential risk.
Index analysis
The vulnerabilities reportedly include ways to bypass web authentication, achieve unauthorized admin access without credentials, and detect errors in TLS, AES-GCM, and SSH encryption implementations.
Governance controls
Anthropic restricted access to Mythos to a limited number of organizations and conducted security reviews of vulnerability reports before disclosure to open-source maintainers and software vendors.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.