South Korea holds emergency meetings over AI cybersecurity threats
South Korea's government held emergency meetings with telecommunications and financial sector officials after Anthropic's Mythos AI model reportedly discovered a previously unknown vulnerability in OpenBSD and demonstrated the ability to design and execute cyberattacks autonomously. Officials expressed concern about potential threats to critical financial infrastructure.
What happened
Anthropic's AI model Mythos identified a previously undiscovered system vulnerability in OpenBSD that had gone undetected for 27 years and designed an infiltration pathway, according to South Korean news reports. The model independently executed the entire process from vulnerability discovery through attack code generation without human intervention, using only a single-line command.
South Korea's Ministry of Science and ICT held emergency meetings on 14 April 2026 with chief information security officers (CISOs) from SK Telecom, KT, LG U+, Naver, Kakao, Woowa Brothers, and Coupang to review security threats and conduct urgent security assessments. The Financial Services Commission separately convened emergency meetings with financial sector CISOs on 15 April 2026 to assess impacts on financial systems.
Reported impact
Security experts expressed concern that if misused, the model could paralyze financial system infrastructure, as financial systems involve complex interconnected payment and transfer mechanisms. International financial authorities including the U.S. Federal Reserve and Treasury Department reportedly held emergency meetings with major Wall Street bank CEOs.
Index analysis
The model demonstrated a 56.8 percent accuracy rate on the HLE (doctoral-level expert reasoning test) and 83.1 percent on hacking simulation tests. Anthropic stated it would not make the model publicly available and would provide it selectively to a small number of major technology companies under Project Glasswing.
Governance controls
The Ministry of Science and ICT directed companies to conduct emergency security reviews and instructed them to share any AI-enabled attack information with the Korea Internet & Security Agency (KISA).
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.