Mythos AI vulnerability detection raises DeFi security concerns
Anthropic's Mythos AI model, known for advanced vulnerability detection in smart contracts, is set for public release, prompting DeFi security warnings. The AI tool has successfully identified critical bugs like a Zcash flaw, raising concerns that widespread access could accelerate exploit discovery while also noting broader improvements in DeFi security infrastructure.
What happened
Anthropic's Mythos AI model, which has been restricted since April to about 50 organizations through Project Glasswing, is set to expand access to approximately 150 more organizations across 15 countries.
The DeFi Investor warned on June 9 that Mythos's capability at finding severe vulnerabilities could accelerate exploit discovery once made publicly available, urging users to revoke token approvals and use only audited dApps.
Claude Opus 4.8 identified a critical bug in Zcash's shielded Orchard pool that would have allowed minting unlimited tokens, causing Zcash's value to fall more than 35% in one day as investors like Arthur Hayes exited positions.
Reported impact
Token approvals that accumulate over time represent standing attack surfaces if approved contracts become vulnerable, with improved AI tools potentially accelerating the discovery of these weaknesses.
The Zcash vulnerability discovery demonstrates the concrete risk posed by AI-assisted vulnerability detection, as the 35% single-day price drop illustrated the market impact of identified critical flaws.
Index analysis
DeFi losses from smart contract exploits have declined 74% from $2.62 billion in 2022 to $680 million in 2025, with improved results in categories like cross-chain bridge attacks and flash loan manipulations.
However, total crypto hacking losses increased 46% in 2025 to $2.935 billion, with the shift in attack vectors toward operational and human errors rather than smart contract flaws, suggesting AI acts as a symmetric accelerator for both defenders and attackers.
Governance controls
Anthropic's Project Glasswing restricted Mythos access to 50 organizations including Amazon, Apple, Google, and Microsoft to direct the model's capabilities toward defensive purposes before broader release.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.