BT explainer: Why Anthropic’s Claude Mythos could become a major security risk?

Anthropic, the US-based Artificial Intelligence (AI) company, has introduced its new frontier AI model “Claude Mythos” in preview in April. Anthropic’s Mythos comes with advanced cybersecurity capabilities that can autonomously analyse codebases and identify "Zero-day" vulnerabilities. While it can strengthen critical software systems against fraud, officials have raised serious concerns about its potential misuse. 

Due to its claimed advanced capabilities, Anthropic has restricted access to Mythos, and its preview is only available to about 40 tech and banking partners under "Project Glasswing." But what exactly is Anthropic’s Claude Mythos, and why are authorities in the US and UK expressing concern?

Must read: Anthropic’s Mythos breached! Unauthorised access raises security concerns

What is Claude Mythos?

According to Anthropic’s blog post, Claude Mythos Preview is a general-purpose AI model built with coding and reasoning capabilities. The company claims that its capabilities outperform previous generation models, like Claude Opus 4.6, and it is extremely powerful. 

In early testing, Mythos identified a 27-year-old flaw in OpenBSD that lets fraudsters remotely crash any system by simply connecting to it. It also found a 16-year-old bug in FFmpeg, a widely used video-processing software. The AI model autonomously identified these flaws, without any human intervention, making it unique and powerful among competitors. 

Who can access the model?

Anthropic’s Claude Mythos is being deployed under “Project Glasswing” with partner companies including Amazon Web Services (AWS), Apple, Cisco, CrowdStrike, Google, Microsoft, NVIDIA, Cisco, CrowdStrike, and others. These companies come under the list, which includes 40 companies. 

In addition, the US National Security Agency (NSA) also has access to the model, despite Anthropic’s government ban and the Department of Defence “supply-chain risk” label, according to an Axios report.

As of now, the model access is limited to evaluating potential risks to their operations and customers. But why does this concern government officials and researchers around the world, or is it just hype?

Must read: Anthropic’s latest AI model ‘Mythos’ triggers urgent risk review by UK regulators: Report

Why are authorities concerned about Claude Mythos?

While its ability to autonomously find and exploit vulnerabilities in every major operating system and browser is impressive, media reports suggest that powerful AI models like Claude Mythos could be misused if it goes into the wrong hands. The model is anticipated to have the potential to create more aggressive and destructive cyberattacks. 

Anthropic says, “Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely.”

Recently, UK financial authorities, including the Bank of England, the Financial Conduct Authority, and the Treasury, have been in serious talks with the National Cyber Security Centre to analyse the Mythos threat to critical systems and software used in finance. 

On the other hand, the U.S. Treasury Secretary Scott Bessen also held an urgent meeting on April 7 with ​Wall Street banks to warn CEOs about cyber risks associated with the Claude Mythos model. 

Must read: Anthropic can be of ‘great use,’ says Donald Trump despite Pentagon ban

On April 17, the White House also had a discussion with  Anthropic CEO Dario Amodei about collaboration, cybersecurity and balancing AI ​innovation with safety. 

Therefore, Anthropic’s Claude Mythos preview will not be released to the general public before safety evaluations and defensive cybersecurity testing under Project Glasswing. Now, the AI model has created a dilemma about securing the technical system or encouraging an uncontrollable technology.