Anthropic has released a new AI model that feels genuinely unsettling in its capabilities. While AI hype is often exaggerated, cybersecurity is one domain where its impact can no longer be ignored. Their projects, Glasswing and Claude Mythos, highlight a major shift: during testing, Mythos Preview was able to independently identify and exploit zero-day vulnerabilities across major operating systems and browsers, including bugs that are decades old. Unlike earlier AI systems that mostly hallucinated code or produced unreliable results, this model demonstrates a significant leap in capability. It not only writes exploits but also discovers complex vulnerabilities—such as race conditions and use-after-free bugs—and chains them together into sophisticated attacks, including sandbox escapes and remote code execution.
What’s particularly striking is the scale of improvement. Earlier models had very low success rates in writing functional exploits, but Mythos achieved over 70% success when given a vulnerability. Beyond that, it can autonomously analyze systems, understand code paths, and generate working exploit chains across different environments like Linux, FreeBSD, and browser engines. It has even identified weaknesses in memory-safe systems, showing that no layer of modern software is entirely immune.
To manage this power, Anthropic introduced Project Glasswing, collaborating with major tech companies like Cisco, Nvidia, Microsoft, Palo Alto Networks, Broadcom, and VMware to strengthen critical infrastructure. However, the company has chosen not to release Mythos publicly, citing the risk of widespread misuse. This decision is controversial: while restricting access may prevent malicious use, it also concentrates powerful capabilities within a small group of organizations. In cybersecurity, where attackers only need to succeed once while defenders must succeed every time, releasing such a tool publicly could tilt the balance in favor of attackers.
At the same time, AI is lowering the barrier to entry in security research. Traditionally, finding vulnerabilities required deep expertise across multiple domains. Now, with AI assistance, a single researcher can perform work that previously required teams of specialists. This could dramatically increase the number of discovered vulnerabilities, especially in less-audited or rapidly changing codebases, such as browsers or critical infrastructure systems.
In the long term, this technology may lead to more secure software, especially when combined with safer programming languages like Rust. However, there is likely to be a turbulent transition period where vulnerabilities are rapidly discovered and exploited before defenses can catch up. Ultimately, AI-powered security research could reshape the entire landscape—making systems safer over time, but potentially far more volatile in the short term.