Anthropic Limits “Claude Mythos” AI Model to 50 Critical‑Infrastructure Vendors – Powerful Automated Vulnerability Discovery Now Restricted
What Happened – Anthropic announced that its new AI model, Claude Mythos, can automatically locate and weaponize software vulnerabilities at a scale far beyond prior models. Because the capability is deemed “too dangerous” for open release, access is limited to roughly 50 organizations—including Microsoft, Apple, AWS, and CrowdStrike—under the “Project Glasswing” program.
Why It Matters for TPRM –
- The model can uncover zero‑day flaws across operating systems, browsers, and core libraries, creating a potential supply‑chain weapon for any third‑party that gains access.
- False‑positive rates and the lack of public validation make risk‑assessment of vendors using Mythos uncertain.
- Concentrating the tool among a handful of large vendors leaves smaller suppliers exposed to attacks that leverage the same AI without the benefit of early patches.
Who Is Affected – Technology SaaS providers, cloud infrastructure operators, endpoint security firms, and any downstream vendors that rely on software components audited by the participating organizations.
Recommended Actions –
- Identify whether any of your critical suppliers are part of Project Glasswing or have been granted Mythos access.
- Request transparency on how Mythos‑derived findings are validated and integrated into patch cycles.
- Augment existing vulnerability‑management programs with manual code review and AI‑output verification to mitigate hallucinated findings.
Technical Notes – Mythos demonstrated the ability to weaponize 181 distinct attacks against Firefox, compared with only two from Anthropic’s prior flagship model. The AI also surfaced decades‑old bugs (e.g., a 27‑year‑old OpenBSD flaw). Attack vector is “automated AI‑driven vulnerability discovery”; no specific CVE is disclosed. Data types at risk include source code, binary executables, and configuration files across OS kernels, browsers, and media libraries. Source: Schneier on Security