German Cybersecurity Agency Warns of AI-Driven Vulnerability Discovery Risks
Anthropic's Claude Mythos, an AI system for discovering software vulnerabilities, reportedly found thousands of serious security flaws in major operating systems and browsers. Germany's BSI warned the technology could shift the cyberthreat landscape and risks falling into attackers' hands, raising concerns about national security implications.
What happened
Anthropic developed an AI model called Claude Mythos designed to discover hidden software vulnerabilities. The company announced it had found thousands of serious vulnerabilities using the tool, including in widely-used operating systems and web browsers.
The German Bundesamt für Sicherheit in der Informationstechnik (BSI) warned that such AI-driven vulnerability discovery could have significant impacts on the cybersecurity threat landscape. BSI President Claudia Plattner stated the agency had not tested the tool but gained insight into its functioning through personal discussions with Anthropic developers.
Reported impact
The BSI warned that with rapid progress in artificial intelligence, such capabilities could soon be available to online attackers. The agency expects this technology could shift attack vectors and trigger a paradigm change in the cyberthreat landscape.
The BSI cautioned that if the trend continues logically, there could be no unknown classic software vulnerabilities in the medium term, which would require a fundamental shift in cybersecurity approaches. The agency raised questions about how long such powerful tools will remain available on the open market and noted implications for national and European security.
Governance controls
Anthropic announced plans to provide access to Claude Mythos to select cooperating corporations including Apple, Amazon and Microsoft so they can find security gaps in their software. The company stated it does not plan to make Mythos publicly available. Other cooperation partners named included the Linux Foundation, cybersecurity firms Crowdstrike and Palo Alto Networks, and network specialist Cisco.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.