Anthropic’s Claude Mythos AI model is driving a surge in software updates, risking exposure of critical national infrastructure to hackers and prompting cyber security chiefs to demand better co-ordination between government and business.
Companies that have access to the San Francisco group’s new tool told the FT joint action “across the public and private sectors” was essential to support hospitals, banks and utilities vulnerable to the threats Mythos uncovered.
“The way I think about this is there is a world pre-Mythos and there is a world post-Mythos,” said Jeetu Patel, president and chief product officer at tech group Cisco, one of the few companies given access to the model.
Anthropic plans to roll Mythos out gradually, following its release to a small group of 40 organisations that are mostly US-based. This includes Amazon and Microsoft as well as large banks such as JPMorgan Chase.
This has led some companies to receive more “patches” — technical fixes that close vulnerabilities found by Mythos.
Bryan Preston, chief financial officer of US bank Fifth Third, told the FT that its technology provider, Microsoft, had rolled out almost 150 software updates since Mythos’s release.
The volume of bugs Anthropic’s model identified could trigger a “flood of patches”, said Haider Pasha, vice-president and chief security officer for Emea at cyber security group Palo Alto Networks. That could challenge businesses that need to keep systems running smoothly, he added.
Anthropic unveiled Mythos earlier this month and touted its ability to detect cyber security flaws faster than humans.
Palo Alto Networks has warned the new technology will quickly proliferate beyond the models built by US tech groups, which have guardrails to prevent malicious use, and could enable hackers to “develop autonomous attack agents unlike anything the industry has faced”.
Pasha said frontier models such as Mythos were notable for their abilities to “chain together vulnerabilities” to bypass security systems.
Cyber security experts have suggested software developers would need to be selective in the updates they released to avoid overwhelming customers.
This week, Anthropic said it was investigating reports that a group of users had gained unauthorised access to Mythos through third parties. Central bankers, financial institutions and regulators have demanded expedited access to Mythos in recent days, but the start-up has declined to provide a timeline.
While many companies were susceptible, critical infrastructure groups were especially attractive targets, said Cisco’s Patel. Such systems often run older software and are seen as higher-value targets.
“The challenge with patching [is] you actually have to bring down your system sometimes and most organisations can’t afford to have downtime, so they do the downtime at scheduled intervals [to] update the systems,” Patel said.
