Anthropic’s Mythos forces rethink of vulnerability management
Anthropic’s Mythos forces rethink of vulnerability management
Publish Date: 2026-04-29 16:24:00
Source Domain: www.informationweek.com
In the 1979 Sci-Fi classic “Alien,” Ellen Ripley refuses to break protocol, recognizing that an unvetted threat allowed past the airlock could endanger the entire ship.
Had the crew members of the USCSS Nostromo followed her lead, most of them would likely have survived. Instead, they were up against a threat that evolved faster than they could respond in a coordinated way — a cinematic nightmare made real in recent weeks as AI-imbued security systems like Anthropic’s Mythos show how attacks can slip through controls and outrun traditional defenses at machine speed.
For CIOs, the emergence of Mythos and its ilk is a call to rethink the step-by-step protocols of vulnerability management for a reality in which attacks are automated and executed at machine speed before most teams can respond.
Mythos testing exposes both zero-day and longstanding vulnerabilities
Earlier this month, Anthropic launched Claude Mythos Preview, a general-purpose language model to be used within Project Glasswing, which includes a select group of about 50 open source, technology and cybersecurity companies — including AWS, Apple, Palo Alto Networks and Nvidia — tasked with testing the AI model.
Mythos is being used by Anthropic and Project Glasswing to identify and exploit zero-day vulnerabilities in open source codebases. Anthropic’s own testing of Mythos uncovered that the AI is “capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and every major web browser when directed by a user to do so.” The Mythos tests even identified some vulnerabilities that are over 20 years old. In addition, less than 1% of potential vulnerabilities uncovered by Mythos have been fully patched by their maintainers, according to Gartner. Over 99% of vulnerabilities revealed by Mythos haven’t been patched.
For its part, Anthropic is optimistic that the cybersecurity industry can adapt to
