Anthropic restricts Claude Mythos: why a vulnerability-hunting tool is dangerous for everyone

Anthropic has released a new model, Claude Mythos Preview, specialized in automatically finding vulnerabilities in software code. The company could have released the tool to the general public but chose not to. Instead, only a selected group of companies and organizations got access, to scan their own software. Behind this decision lies a serious question about the boundary between innovation and security.

What Claude Mythos can do

Claude Mythos Preview specializes in finding vulnerabilities in source code with high accuracy. The model can automatically scan an application, identify potential security problems and recommend fixes. Anthropic built the tool for this defensive task: to help developers and companies find and fix bugs in their own software before attackers or competitors discover them.

Companies in the Glasswing program and other selected organizations got access, and they use Claude Mythos in a strictly controlled environment. This lets Anthropic collect data on how the tool performs in real-world conditions while ruling out the risk of a leak or uncontrolled distribution.

Why experts are alarmed

Claude Mythos is comparable in power to other modern AI models, but the consequences of using it are asymmetric, and they worry experts. Bruce Schneier, a cryptographer and one of the world's leading security specialists, points out the obvious: the same tool in the hands of hackers and cybercriminals could become a weapon for mass vulnerability hunting across entire industries.

• Faster attacks — automated vulnerability discovery will make hacking larger in scale and faster
• Asymmetric defense — defenders are forced to patch bugs in a rush, while attackers move faster
• Unpredictability — even the tool's creators cannot fully predict every use scenario

The question is not whether Claude Mythos has unique power compared with competitors. The question is what happens to cybersecurity as a whole when such tools become ever more accessible.

Anthropic's strategy: restriction and control

Anthropic chose a cautious, conservative path. Instead of an open release on GitHub, the company restricts access and monitors usage inside private organizations. This means:

"We studied the risks and decided that controlled distribution is more

responsible than a public release," the company is essentially saying with its restriction.

But the decision raises new questions and contradictions. How long can Anthropic keep the model closed? What happens when OpenAI, Google or other industry leaders build a similar tool? Will restricting access to powerful security tools become the new norm?

What it means

Anthropic is trying to strike a fragile balance between progress and risk, but the arrangement is temporary. Sooner or later, similar tools will become more accessible, and competition between companies will force wider releases. The real challenge is not closing off access to a single tool but developing new global standards for governing powerful AI systems and a culture of responsibility around them.