Anthropic's Mythos AI model finds critical system vulnerabilities
Anthropic announced that its new Mythos AI model discovered serious security vulnerabilities in major operating systems and web browsers. The company withheld public release and launched Project Glasswing, allowing tech giants to patch flaws before broader availability, while financial regulators expressed concerns about potential risks to financial systems.
What happened
Anthropic announced that its new Mythos AI model discovered serious security vulnerabilities in all major operating systems and web browsers.
Anthropic withheld public release of Mythos and instead launched Project Glasswing, giving tech companies including Apple and Google access to the tool to patch vulnerabilities before broader availability.
Financial regulators raised concerns about the model's potential risks. Bank of England called a crisis meeting with London politicians to warn about risks to the financial system, while U.S. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell held a crisis meeting with Wall Street bank chiefs.
Reported impact
The model can find vulnerabilities faster than any human, with timeframes for finding and fixing flaws compressed from days, months and years to seconds, minutes and hours.
Financial institutions expressed concern that Mythos could cause chaos in the financial system if misused.
Index analysis
Security experts noted that Anthropic is not alone in discovering vulnerabilities using AI, with Meta, Google and Deepseek models already capable of finding many vulnerabilities.
Research from AI security company AISLE suggested several vulnerabilities highlighted by Anthropic could likely already be detected using freely available AI models.
Experts warned that if a sufficiently powerful open-source model emerges, the threshold for advanced cyberattacks could drop dramatically as attackers would only need to pay for hardware and electricity.
Governance controls
Anthropic implemented a controlled disclosure process through Project Glasswing, restricting early access to the tool to major technology companies for vulnerability patching.
Anthropic classified Mythos as too dangerous to release publicly pending resolution of security concerns.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.