Anthropic's Mythos AI Revealed for Hacking Capabilities and Limited Access

Anthropic, an AI company, created a model named Mythos that can detect cybersecurity vulnerabilities in software and operating systems. The model's existence was revealed last month through unsecured content on the company's website. Anthropic stated on its website that Mythos found thousands of high- and critical-severity vulnerabilities.

The company decided to keep Mythos from public access because of its hacking abilities, which could have severe implications for economies, public safety, and national security. Anthropic did not respond to requests for comment from New Scientist.

Testing Anthropic is providing access to Mythos to select companies including Amazon Web Services, Apple, Google, JPMorganChase, Microsoft, and NVIDIA through Project Glasswing. This initiative allows these firms to identify bugs in their software. Additionally, members of a private online forum gained unauthorized access by guessing the model's online location.

Bobby Holley at Firefox reported that Mythos helped identify 271 vulnerabilities in the web browser. He stated that none of the bugs were beyond what an elite human researcher could find.

The AI Security Institute tested Mythos and found it capable of attacking small, weakly defended systems but not highly secure ones. The institute noted it represents an improvement over previous models and warned that such capabilities are advancing rapidly.

The AI Security Institute did not provide further comment to New Scientist. Kevin Curran at Ulster University stated that Mythos triggered alarm in the security industry, with researchers divided on the threat level. Alan Woodward at the University of Surrey said the AI finds vulnerabilities faster and more thoroughly than humans but not ones humans could not discover.

Davi Ottenheimer described the situation as a legitimate capability reframed as a civilizational threat by a benefiting party.

indicate that Mythos could improve cybersecurity by allowing software maintainers to find and patch flaws efficiently. Anthropic stated that such AI models will ultimately benefit defenders more than attackers. Kevin Curran advised treating Mythos as a warning and preparing for similar capabilities in adversaries' hands within 18 months.