The past few weeks have brought apparently alarming news of Mythos, an AI that can identify cybersecurity flaws in a matter of moments, leaving operating systems and software vulnerable to hackers. The cybersecurity community is now beginning to get a better sense of how Mythos may change the face of cybersecurity 鈥� and not necessarily for the worse.
What is Mythos and why are people concerned by it?
Mythos is an AI created by Anthropic. Its existence was accidentally revealed last month when people unearthed , which had been left unsecured for anyone to see.
Advertisement
According to Anthropic, there鈥檚 a good reason the model had been kept behind closed doors: it is 鈥� by accident rather than design 鈥� extremely good at hacking. It can allegedly discover flaws in virtually any software, if asked, that would allow the user to break in.
The company says that Mythos found thousands of high- and critical-severity vulnerabilities in operating systems and other software. Anthropic did not respond to New 杏吧原创鈥�s request for comment, but the company that 鈥渢he fallout鈥攆or economies, public safety, and national security鈥攃ould be severe.鈥�
The company says it took the responsible step of keeping it hidden.
So nobody at all is able to use it?
Not quite. Anthropic has decided to make it available to a select group of technology and finance giants like Amazon Web Services, Apple, Google, JPMorganChase, Microsoft and NVIDIA under something called so that they can uncover any bugs in their own software before someone else does.
Members of a private online forum have also managed to gain unauthorised access to the trial. suggest that they simply made an 鈥渆ducated guess鈥� about where the model would be hosted online 鈥� the same sort of issue that led to the revelation of the existence of Mythos in the first place. Perhaps a company so concerned about cybersecurity should pay more attention to their own.
While the model was initially due to be kept under wraps and out of use, it鈥檚 now gaining huge attention and being tested by some of the world鈥檚 best cybersecurity experts. Many of those companies are also Anthropic鈥檚 largest potential customers, of course 鈥� and hype about the power of Mythos will certainly do Anthropic no harm.
Security expert Davi Ottenheimer summed up the situation as 鈥渁 legitimate technological capability, reframed as civilisational threat, by a party that benefits from the reframing鈥�.
Is it as dangerous as people are making out?
at Ulster University, UK, says that the revelation of Mythos and what it might be able to do 鈥渢riggered alarm across the security industry鈥�, although researchers were divided on how serious the threat actually was. 鈥淲hat happens when a machine can do in seconds what a skilled human hacker takes months to accomplish?鈥� he wonders.
But there are indications that it isn鈥檛 time to panic yet. Bobby Holley at Firefox 鈥� one of those organisations being given access to Mythos 鈥� that the model helped his team find 271 vulnerabilities in the web browser, which is certainly quite a haul, but that none were so ingenious, impenetrably complex or sophisticated that a human 肠辞耻濒诲苍鈥檛 have dug them out.
鈥淛ust one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it鈥檚 even possible to keep up,鈥� wrote Holley. 鈥淓ncouragingly, we also haven鈥檛 seen any bugs that 肠辞耻濒诲苍鈥檛 have been found by an elite human researcher.鈥�
The AI Security Institute (AISI) 鈥� set up under then-UK Prime Minister Rishi Sunak after the UK鈥檚 AI Summit in 2023 鈥� has also . In tests, it was found to be capable of attacking only 鈥渟mall, weakly defended and vulnerable enterprise systems鈥� and there was no indication that a really secure bit of software or network would be at risk, although it was a step up in ability from previous models. And AISI did warn that these things are improving fast. AISI did not comment when asked by New 杏吧原创 to discuss the threat.
at the University of Surrey, UK, has a pragmatic view of the threat posed by Mythos 鈥� and all other AI models in general, which also have the ability to spot cyber vulnerabilities to varying degrees. 鈥淭he AI is not necessarily capable of finding vulnerabilities that a human wouldn鈥檛, but it鈥檚 just so much faster, thorough and relentless. Hence it鈥檚 finding vulnerabilities that humans have missed,鈥� he says. 鈥淎I, as demonstrated by Mythos, is making the attacker鈥檚 job more efficient and giving them a speed and agility that make defence harder, but not impossible.鈥�
So it seems that while Mythos can find flaws at scale and speed, it isn鈥檛 finding anything devastatingly dangerous yet. And there are even reasons to believe that it could actually be a good thing.
How can a hacking AI be positive?
鈥淭he defects are finite, and we are entering a world where we can finally find them all,鈥� wrote Holley. In essence, if you make or maintain software then you can also use Mythos to pick apart your own code and patch it 鈥� perhaps even before it鈥檚 released.
AI will almost certainly get more capable of finding flaws and malicious attackers will almost certainly benefit from this to some extent. But this will also help software-makers 鈥� although those who maintain ageing, clunky government software written decades ago may find keeping up challenging.
Even Anthropic believes that hacking AIs will eventually 鈥� but then again, saying the opposite would make it hard to justify making them.
Essentially, AI is making 鈥� and will continue to make 鈥� both hacking and defending from hackers easier, but those who ignore the technology will find themselves at a big disadvantage.
鈥淭reat Mythos as the warning shot it is,鈥� says Curran. 鈥淎nd assume that within 18 months, comparable capabilities will be in the hands of adversaries. The window to get ahead of this is open, but it is closing fast.鈥�
