Anthropic has decided against a broad release of its new AI model, Claude Mythos, citing significant cybersecurity risks. The company has acknowledged that the model demonstrates "unprecedented" capabilities in identifying vulnerabilities, a power that could equally empower malicious actors. Mythos has shown an ability to discover zero-day vulnerabilities, some critical, at a speed and scale exceeding human capacity, raising concerns that it could enable cyberattacks to outpace defensive measures.
The AI developer has instead initiated Project Glasswing, a restricted initiative offering Mythos access to a select group of around 40 cybersecurity and software firms. This limited rollout aims to leverage the model for defensive security work, allowing these organizations to bolster defenses before wider availability, if any.
Model's Capabilities and Concerns
Recent testing of Mythos revealed its capacity to uncover thousands of vulnerabilities, including remote code execution flaws, within weeks. An Anthropic engineer reportedly tasked the model with finding such bugs, with Mythos succeeding overnight. The model's performance gap compared to existing AI systems is described as substantial, not incremental. Anthropic's internal assessments confirmed that the model understood the deceptive implications of its findings.
Read More: Google Apps Location Errors Stop Users Accessing Services in Their Country
"We did not feel comfortable releasing this generally," stated Logan Graham, who heads Anthropic's AI model defense team, in remarks to CNN.
Background and Development
Details surrounding Claude Mythos initially surfaced via a data leak around March 26-29, prompting market reactions with cybersecurity stocks seeing a downturn. Anthropic officially acknowledged the model and Project Glasswing on April 7. This initiative is designed to secure critical software infrastructure in the age of advanced AI.
While Mythos is being made available to select cybersecurity defense organizations first, Anthropic has also been reportedly in discussions with the U.S. government regarding the model's implications. The company has previously released other powerful models, such as Claude Opus 4.6, on February 5, but deems Mythos too potent for public dissemination at this stage. The development comes amidst broader industry trends, with rivals like OpenAI also reportedly developing advanced models.
Read More: Axios npm Malware Attack 2023: Developers Face New Risks
Concerns about AI's potential for misuse in cybersecurity are not new, with researchers like Gadi Evron, founder of AI security firm Knostic, noting the widening gap between AI-accelerated attackers and defenders. Experts emphasize that the speed and scale at which AI agents can probe for vulnerabilities represent a fundamental shift in the cybersecurity landscape.
