Japan, US respond to cyberattack risks from Claude Mythos AI
Anthropic's Claude Mythos AI model demonstrates exceptional capability for identifying software vulnerabilities, reportedly finding in hours a flaw undetected by experts for 27 years. Due to concerns about potential misuse in cyberattacks, Anthropic has withheld public release, and governments in Japan and the US are responding with enhanced cybersecurity coordination and warnings to critical infrastructure operators.
What happened
Anthropic developed Claude Mythos, a new AI model with significantly enhanced ability to identify software vulnerabilities. According to Anthropic, Mythos found a vulnerability that experts had not discovered in 27 years within only hours.
Anthropic has withheld public release of Mythos due to concerns that its vulnerability-detection capabilities could be misused for cyberattacks. The model was originally built as a general-purpose language model with improved coding and reasoning abilities, and its security capabilities emerged as a byproduct.
Reported impact
Security experts characterized the defensive position against Mythos as overwhelmingly disadvantaged. An executive at IT security company Tanium described Mythos's vulnerability-discovery ability as dramatically surpassing the level of human experts.
The Japanese government expressed urgent concern about new cybersecurity threats posed by advanced AI models like Mythos being misused in cyberattacks.
Index analysis
On 28 April 2026, Japan's Chief Cabinet Secretary Kihara Toshishige stated in a press conference that the government faces new cybersecurity threats and announced plans to issue alerts to critical infrastructure operators and exchange information with major US IT companies.
Japan's Financial Services Minister announced formation of a task force to ensure financial infrastructure security in response to Mythos.
Governance controls
Anthropic has delayed public release of Claude Mythos. The company cited concerns about potential cyberattack misuse as the reason for withholding general availability.
The Japanese government indicated plans to alert critical infrastructure operators and coordinate with US entities, while emphasizing the importance of operators applying security updates and implementing basic security measures.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.