Anthropic CEO warns cyber danger

Software security just got a lot weirder. Anthropic’s CEO, Dario Amodei, said on May 5 that his company’s newest model, Claude Mythos Preview, has exposed so many serious software flaws that banks, governments, and tech companies now have a narrow patching window before attackers catch up. He put that window at 6 to 12 months. The basic idea is stark — AI is getting good enough at finding and exploiting bugs that the old pace of defensive cleanup may no longer work. (cnbc.com) ### What actually changed today? The new part is not that Mythos exists — Anthropic unveiled it on April 7 — but that Amodei publicly framed the situation as a “moment of danger” during a New York event with JPMorgan Chase CEO Jamie Dimon. Anthropic also used the event to push deeper into finance with 10 new AI agents for banks(cnbc.com) telling them the cyber clock is ticking. (cnbc.com) ### What is Mythos, exactly? Mythos is Anthropic’s restricted-release frontier model for advanced coding, reasoning, and cybersecurity work. Anthropic says it is unusually strong at identifying and then exploiting zero-day vulnerabilities — undiscovered bugs — across major operating systems and web browsers. The company has not(cnbc.com)patch systems could help criminals break into them faster. (red.anthropic.com) ### Why are people taking this seriously? Because the numbers jumped. Amodei said an earlier Anthropic model found roughly 20 Firefox vulnerabilities, while Mythos found nearly 300. Anthropic’s technical write-up says the model identified and exploited zero-days in every major operating system and every major browser it tested, and that many of the bugs were 10 or 20 (red.anthropic.com) operating system famous for being hard to break. (cnbc.com) ### Is this just Anthropic talking its book? Not entirely. The UK AI Security Institute tested Mythos Preview and said it showed a real step up over earlier frontier models. In controlled evaluations, the institute saw it carry out multi-stage attacks on vulnerable networks and autonomously discover and exploit flaws — work it (cnbc.com)te. That does not mean AI can now hack anything. But it does mean the ceiling moved. (aisi.gov.uk) ### So what is Project Glasswing? Project Glasswing is Anthropic’s attempt to turn that dangerous capability into a defensive head start. Launch partners include AWS, Apple, Cisco, Google, JPMorganChase, Microsoft, Nvidia, Palo Alto Networks, and the Linux Foundation. Anthropic says it has extended access to more than 40 additional (aisi.gov.uk)ty groups. Basically, the plan is to let major defenders patch critical infrastructure before offensive use spreads. (anthropic.com) ### Why does China keep coming up? Amodei’s timeline rests on competitive diffusion. He said Chinese AI models may be only 6 to 12 months behind Mythos. If that is even roughly right, then the current advantage belongs to whoever can use frontier AI for defense first. The catch is that software ecosystems are huge, patch cycles are slow, and many important systems run ancien(anthropic.com) companies act on it. (cnbc.com) ### What are defenders supposed to do now? Anthropic’s own materials point toward boring but urgent work — dependency scanning, faster patch pipelines, tighter privilege controls, and coordinated disclosure so flaws get fixed before details spread. That sounds mundane next to frontier AI hype, but turns out that is the point. If AI can surface thousands of bugs at once, operational discipline becomes the bottleneck. (red.anthropic.com) ### Bottom line? This is not a movie plot where one model instantly breaks the internet. It is more unsettling than that. The likely near-term outcome is a grinding race between AI-assisted defenders and AI-assisted attackers — and Amodei is saying that race has already started. (cnbc.com)