Anthropic has released a large-language model called Claude Mythos that can automatically discover and exploit software vulnerabilities [1].
The tool represents a significant shift in cybersecurity because it can locate and weaponize software flaws in moments [1, 5]. This speed creates a risk that malicious actors could use the technology to launch rapid, large-scale attacks if the model is accessed by the wrong individuals [1, 5].
Anthropic first announced the existence of Mythos on April 7, 2024 [2, 4]. During seven weeks of testing, the model discovered more than 2,000 previously unknown software vulnerabilities [4].
Because of the potential for misuse, the company initially limited the model's availability. The Wall Street Journal reported that Mythos was shared only in a controlled environment with cybersecurity researchers, and major technology companies [1]. However, recent reports indicate that Anthropic is now accelerating the rollout of Mythos for a wider release to additional partners [2].
The model's ability to act as a "superhacker" allows it to identify gaps in code that human analysts might miss. While these capabilities can help developers patch security holes before they are exploited, the same functionality allows an attacker to automate the creation of exploits [1, 3].
Anthropic said the model could be dangerous in the wrong hands [1]. The company said it has attempted to balance the need for security research with the risk of providing a powerful tool to bad actors [1, 2].
“Claude Mythos can automatically discover and exploit software vulnerabilities.”
The release of Claude Mythos signals an escalation in the AI arms race between security defenders and attackers. By automating the discovery of zero-day vulnerabilities, Anthropic has provided a tool that can either drastically shorten the time it takes to secure software or provide a blueprint for unprecedented cyberattacks. The transition from a closed beta to a wider partner rollout suggests the company is weighing the benefits of industry-wide patching against the inherent risks of the model's capabilities.
