Anthropic’s Mythos is driving a flood of security patches at AI companies<\/figcaption><\/figure>\n<\/div>\nA single AI model has caused a stir in the cybersecurity industry not by being hackable, but by being very good at finding vulnerabilities. <\/p>\n
Anthropic’s Mythos, released earlier this month to a controlled group of 40 organizations, has already triggered about 150 software updates at a major U.S. bank, and cybersecurity officials are warning that the pace of discoveries could outstrip companies’ ability to safely deploy fixes.<\/p>\n
Mythos was created by Anthropic to identify cybersecurity vulnerabilities at a faster rate than human analysts. In the weeks following its restricted release, results started coming in from the tech stack of those who had received it earlier.<\/p>\n
According to the Financial Times, Fifth Third Bank CFO Brian Preston said that the bank’s technology vendor, Microsoft, has offered about 150 software updates since the release of Mythos.<\/p>\n
When Jitu Patel, president and chief product officer of Cisco, explained the impact of the model, no one was left speechless. “When you consider that there’s a pre-mythos world and a post-mythos world,” Patel says. Cisco is one of a select few companies in the United States to gain access to the model, along with Amazon, Microsoft, and JPMorgan Chase.<\/p>\n
The amount of bugs that have been discovered through Mythos has brought an additional challenge, with a lot of patches coming out very quickly. “There is a possibility of flooding with segments,” warned Haider Pasha, chief security officer of EMEA for Palo Alto Networks. <\/p>\n
Fixing security vulnerabilities often requires system downtime, which critical infrastructure companies should only be able to do during scheduled maintenance periods.<\/p>\n
“The challenge with patching is that you actually have to take your systems down sometimes,” Patel said, “and most organizations can’t afford downtime.” For hospitals, utilities and financial institutions running legacy software on tight operating schedules, this barrier isn’t theoretical, it’s structural.<\/p>\n
This goes beyond that to how Mythos interacts with its users. According to Palo Alto Networks, the technology will spread beyond the safe confines of models designed by US companies and allow hostile groups to create, as Pasha says, “autonomous attack agents like the industry has never seen before”.<\/p>\n
The ability to combine different vulnerabilities and turn them into a series of attacks for a single attack path shows how much more advanced adversarial AI has become.<\/p>\n
It was confirmed earlier this week that Anthropic is currently considering unauthorized access to its technology through third-party platforms, adding further pressure to the organization from central banks, regulators and institutions who need faster access to Anthropic’s product that it has so far denied.<\/p>\n
Cybersecurity officials with access to Mythos told the FT that joint action \u201cacross the public and private sectors\u201d is now necessary to protect critical infrastructure. <\/p>\n<\/p><\/div>\n