UK AI Institute Says Anthropic's Mythos Finds Critical Software Flaws

The UK AI Security Institute reports that Anthropic's Mythos AI model shows a much greater ability to find and exploit new software flaws than past models. The model may uncover weaknesses much faster than human experts, and could lead to more attacks against unpatched systems. Officials warn that Mythos appears to be improving quickly, possibly doubling its capability every four months. Experts suggest that security teams may need to adopt faster patching and better monitoring to keep up. These findings may mean bigger budgets for cybersecurity and more focus on AI oversight, but predictions depend on early test results and could change.

Anthropic's Mythos AI model can find and exploit critical software vulnerabilities significantly better than previous models, according to a new report from the UK's AI Security Institute (AISI). The model's rapidly advancing capabilities, potentially doubling every four months, could enable attackers to weaponize undiscovered flaws faster than ever before. This development places new pressure on cybersecurity teams to accelerate patching, enhance monitoring, and prepare for a future where AI plays a central role in both cyber offense and defense.

Mythos's Performance in AISI Evaluations

During controlled tests, the AISI observed Anthropic's Mythos AI model autonomously executing multi-stage attacks and exploiting unknown vulnerabilities. The model succeeded in 73% of expert-level challenges, a task where no AI had previously succeeded, demonstrating a significant leap in offensive cyber capabilities.

The AISI's public evaluation of the Claude Mythos Preview model revealed its ability to discover flaws and conduct multi-stage attacks autonomously. In expert-level capture-the-flag challenges, Mythos achieved a 73% success rate, a milestone for AI on tasks previously requiring days of human effort, according to the AISI evaluation. Echoing these findings, an (open letter) from the UK government warned that Mythos is "substantially more capable at cyber offence than any model we have previously assessed," with its capabilities estimated to be doubling every four months.

Implications for Vulnerability Management

This dramatic increase in AI capability threatens to significantly shorten the window between a vulnerability's discovery and its exploitation. As AI models like Mythos approach and potentially surpass human expert performance in finding flaws, the risk of widespread attacks against unpatched systems grows. This new reality demands that security organizations develop faster remediation pipelines and improve monitoring for signs of automated reconnaissance.

Recommended Defensive Strategies

Based on the findings, security specialists recommend several near-term actions:

Integrate Automated Security Testing: Incorporate continuous fuzzing and static analysis directly into CI/CD pipelines.
Deploy AI-Powered Defense: Use AI-assisted tools for more efficient log analysis and alert triage.
Enforce Strict Access Control: Implement rigorous role-based access controls (RBAC) for all powerful AI model interfaces.
Monitor for AI-Driven Probing: Actively monitor for unusual scanning patterns that could indicate automated reconnaissance by AI tools.
Accelerate Patch Management: Establish protocols for coordinating and deploying rapid patch rollouts as soon as vulnerabilities are confirmed.

Anthropic's Controlled Release: Project Glasswing

In response to the model's power, Anthropic has restricted access to Mythos through a program called Project Glasswing. Only a select group of technology and cybersecurity partners can use the model, and solely for defensive scanning of their own systems. This controlled deployment strategy addresses concerns that widespread availability could arm adversaries and allow them to launch attacks at an unprecedented scale.

Future Outlook: AI's Impact on Security Budgets

According to industry reports, the acceleration of frontier AI capabilities is happening faster than many experts anticipated. If the AISI's four-month doubling estimate proves accurate, highly capable models like Mythos could become widely accessible within the next year. Consequently, organizations may need to increase security budgets to hire staff skilled in validating AI-generated security findings and to invest in advanced automated patch management systems. However, analysts note these projections are based on preliminary data and are subject to change as further evaluations are conducted.