Anthropic Mythos AI triggers cyber risk scrutiny

Anthropic’s new artificial intelligence model, Claude Mythos, is drawing heightened attention from regulators, lawmakers, and financial institutions after the company said the system can exceed human performance in certain hacking and cybersecurity tasks. The model was revealed in early April as “Mythos Preview,” and its claimed capabilities have intensified debate about how advanced AI could affect the safety of digital services.

 

According to the company, Mythos has already surfaced thousands of high-severity vulnerabilities. Anthropic said the findings include issues affecting every major operating system and web browser, and it cited one vulnerability that had existed in a system for 27 years. Those assertions have helped push the model into policy discussions focused on systemic cyber risk.

 

In response to the model’s potential, Anthropic has provided access to 12 major technology companies through an initiative called Project Glasswing, which is intended to strengthen resilience against the AI’s capabilities. The companies named as participants include Amazon Web Services, Apple, Microsoft, Google, Nvidia, and Broadcom. The arrangement reflects a defensive posture: enabling large technology providers to evaluate and harden systems in light of what the model may be able to do.

 

Officials have also raised the issue in global economic forums. Canadian Finance Minister François-Philippe Champagne said Mythos was discussed at a recent International Monetary Fund meeting in Washington D.C. Bank of England Governor Andrew Bailey separately pointed to the need to assess what the model could mean for cybercrime risk, as concerns extend to the security of global financial systems.

 

At the same time, some cybersecurity experts have urged caution about drawing firm conclusions. They noted that independent analysts have not yet fully tested Mythos, leaving uncertainty about how its performance claims translate into real-world outcomes. The UK’s AI Safety Institute said that while the model is powerful, its primary threat would be directed at poorly defended systems.

 

Experts also emphasized that strong cybersecurity practices can reduce exposure even as tools become more capable. They added that many cyberattacks do not require sophisticated AI, suggesting that baseline security controls remain central to risk reduction.

For policymakers and market participants, the immediate challenge is balancing the model’s potential defensive value—finding and fixing weaknesses—against the possibility that similar capabilities could be used to scale attacks on vulnerable targets.