Anthropic stir rattles markets

Anthropic did not just ship another chatbot this week. On April 7, it unveiled Claude Mythos Preview and said the model was so strong at finding and exploiting software flaws that access would be limited to a small defensive program called Project Glasswing. (anthropic.com, cnbc.com) Anthropic said Mythos could identify and exploit zero-day vulnerabilities, which are bugs nobody has patched yet, across every major operating system and every major web browser in its testing. The company also said more than 99% of the vulnerabilities it found were still unpatched, which is why it withheld technical details. (anthropic.com) That is why the rollout looked less like a product launch and more like a controlled lab test. Anthropic said Apple, Google, Microsoft, Nvidia, Amazon Web Services, CrowdStrike, Palo Alto Networks, and roughly 40 other companies would get access for defensive work instead of a public release. (cnbc.com) Washington reacted like this was a financial-stability problem, not just a software story. On April 10, CNBC and The New York Times reported that Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell discussed Mythos-related cyber risks with major United States bank chiefs. (cnbc.com, nytimes.com) Investors had already started treating AI security tools as a threat to the old cybersecurity business model. On February 23, CNBC reported that cybersecurity stocks fell for a second day after Anthropic introduced a limited research preview that could scan code for vulnerabilities and suggest fixes. (cnbc.com) Cloudflare was one of the names hit in that selloff. CNBC reported Cloudflare fell more than 9% on February 23, and later market coverage tied a fresh Anthropic cybersecurity push to another sharp drop of roughly 13% in Cloudflare shares as traders bet that more security work could move inside foundation models. (cnbc.com, crn.com, phemex.com) The market logic is simple even if the technology is not. If one model can find bugs, explain the bug, write a fix, and help a security team deploy the fix, then some of the work now sold as separate software seats starts to look like a feature inside a larger AI platform. (anthropic.com, cnbc.com) Consulting firms are already trying to package that shift into products. On March 25, Accenture announced Cyber.AI, a security offering built on Claude that it said would combine Anthropic’s model with Accenture agents and its 30,000-plus cybersecurity professionals. (accenture.com) Accenture said Cyber.AI is designed to move security operations from “human-speed response” to continuous AI-driven work, and it added a control layer called Agent Shield to monitor autonomous agents in real time. In the same release, Accenture cited a World Economic Forum report saying nearly nine in 10 organizations see AI-related vulnerabilities as the fastest-growing cyber risk. (accenture.com) So the same Anthropic announcement created two opposite trades at once. One camp saw a company building a new defensive stack with partners like Accenture, and another saw a company compressing parts of the cybersecurity sector into the model layer itself. (accenture.com, cnbc.com, cnbc.com) That is why one model preview reached bank regulators, consultants, and stock traders in the same week. Anthropic is arguing that AI can harden the internet before attackers catch up, while the market is pricing in the possibility that the companies selling today’s defenses may be the ones most exposed if it works. (anthropic.com, cnbc.com, nytimes.com)