ai
Anthropic's Mythos Model Raises Cybersecurity Concerns
Anthropic announced its Mythos AI model on April 7 after it identified thousands of severe security vulnerabilities. The release prompted global discussions on AI risks and defensive measures. OpenAI's GPT-5.5 and coding tools from both companies have also drawn scrutiny.
May 18, 5:00 AM·2m read2 sources
Audio version
Tap play to generate a narrated version.
Anthropic announced on April 7 that its new general-purpose AI model, Mythos, had found thousands of severe security vulnerabilities, some missed by humans for over a decade. The company said the model could exploit every major operating system and every major web browser.
Engineers at the lab used the technology to find working hacks in a single night. Anthropic decided not to release Mythos beyond a group of trusted partners, giving defenders a head start. The announcement stated that it is about to become very difficult for the security community.
The warning reverberated worldwide and led the Trump administration to begin discussing a system to review new AI models.
Last year, coding tools from OpenAI and Anthropic helped developers produce millions of lines of new code. These tools are prone to creating errors and vulnerabilities that developers miss. More companies now use outside code libraries than before, which could allow hacks to spread if vulnerabilities exist in those packages.
Isaac Evans, CEO of cybersecurity startup Semgrep, said everyone is predicting a lot more hacking this year. His company recently found two vulnerabilities in its codebase, both contributed by Anthropic's Claude product. Evans noted that generating ten times the lines of code should be expected to produce ten times the number of vulnerabilities.
Feross Aboukhadijeh, CEO of cybersecurity startup Socket, said developers are reviewing new code less carefully. Combined with reliance on outside code libraries, this creates a perfect storm of danger, he said. The vulnerability surface of all software is expanding really quickly, Aboukhadijeh added.
Security teams already use new AI models to search for vulnerabilities while worrying about attackers gaining access to similar models. On April 7, the Mythos announcement triggered a reckoning for security teams worldwide. A team at Mozilla wrote that Mythos helped them find and fix more security bugs than they had in the previous year.
