Anthropic unveils Claude Mythos: a zero-day-hunting AI shifts the balance of power online

Anthropic has presented Claude Mythos as a model that can autonomously find unknown vulnerabilities and immediately turn them into working attack scenarios. That is why the company did not release the system publicly: by its own description, this kind of AI can do more than point out a weak spot. It can methodically break into it, gain elevated privileges and chain together a series of bugs to take over critical software. These are so-called zero-day vulnerabilities: flaws that developers do not yet know about and for which no ready fix exists. If a tool can find such holes faster than a human, the cost of a mistake rises sharply.

In the usual defense model, companies have time between the discovery of a problem and its mass exploitation. With an AI like this, that window may almost vanish: discovery, code writing, finding a way around defenses and privilege escalation all happen in one loop, without long manual work. Anthropic claims that Mythos can, in theory, link several vulnerabilities together to reach the level of major operating systems and popular browsers.

That makes this not a local problem for one vendor but a question of the resilience of the entire digital infrastructure. If this approach really works, the balance between attackers and defenders changes: hacking no longer requires a team of rare specialists and can rely on a machine that scales expertise, speed and persistence.

Against this backdrop, the company launched Project Glasswing, a limited-access program for organizations that are supposed to use the model's capabilities for defense. 40 partners have already been named, and all of them are American. That is an important detail: tools that can both strengthen security and create systemic risk are concentrated at the center of the American digital ecosystem. Formally, this is preventive defense, where vulnerabilities must be closed before attackers can use them. In practice, though, it means a handful of private entities get exclusive access to a technology whose influence reaches far beyond their own networks.

The only external partner outside the US is the United Kingdom, where the AI Security Institute received access to the system to test frontier models. After seeing its capabilities, British ministers warned businesses that AI will, in the near future, make cyberattacks noticeably simpler, faster and cheaper, and that most companies are not ready for this. According to available information, the next stage may be trials in European banks. It is a logical choice: the financial sector understands the price of vulnerabilities better than most, but it is also especially sensitive to the consequences of mistakes in risk assessment.

The main question here is not only technical but also political. When a system can find universal weak points in widely used software, it becomes an instrument of infrastructure power. Then what matters is not just how well it works, but who decides who gets access, which bugs to close first, where the line runs between research and offensive cyber operations, and how to verify the company's own claims about controlling the risks. The open internet was historically built on distribution and shared rules, not on a few players seeing all the cracks before everyone else.

What this means

The arrival of Claude Mythos shows that the next phase of AI in cybersecurity will be defined not only by model quality but also by the regime of access to models. A technology that scales defense and attack equally well requires not only patches but also new rules of accountability. Otherwise, control over digital security will start shifting from public institutions and the broader ecosystem to a narrow circle of private companies.