Anthropic's Mythos model triggers concerns over AI-enabled cyberattacks
Anthropic released the Mythos AI model, which can identify software vulnerabilities and automatically generate exploits, triggering concerns among banks and tech companies. Security experts report that similar capabilities can be replicated using existing AI models, and warn the model's speed in finding vulnerabilities outpaces organizations' ability to patch them.
What happened
Anthropic released the Mythos AI model, which can identify thousands of software vulnerabilities in global infrastructure. The deployment was restricted to a few American companies including Apple, Amazon and JPMorgan Chase under Project Glasswing.
Security experts note that Mythos can automatically generate functional exploits without human intervention, and that similar vulnerabilities can be reproduced using orchestrated combinations of existing AI models from Anthropic and OpenAI.
Reported impact
Global alarm was triggered in the banking sector and among regulatory authorities over the model's capability to enable cyberattacks. Jamie Dimon, CEO of JPMorgan Chase, stated that while AI promises better defence in the future, it currently makes companies more vulnerable, as the speed at which AI discovers breaches far exceeds companies' ability to apply security patches.
Experts warn that democratisation of exploit-generation capabilities through AI increases risks for vulnerable institutions such as schools and hospitals. The speed advantage of AI in finding vulnerabilities compared to human remediation capacity creates a significant defence-attacker imbalance.
Index analysis
Security experts cited by CNBC stated that vulnerabilities discovered by Mythos can be reproduced through intelligent orchestration of older AI models already accessible from Anthropic or OpenAI. Klaudia Kloc, CEO of Vidoc, warned that current models are already powerful enough to detect zero-day vulnerabilities at scale, a phenomenon occurring for months.
Governance controls
Anthropic restricted access to Mythos to a small number of American tech and financial giants under Project Glasswing, intended to give the corporate sector sufficient time to strengthen defences before potential large-scale attacks. Global banks, technology giants and regulatory bodies accelerated measures in the preceding month to contain risks associated with the model.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.