{"id":2565,"date":"2026-04-17T11:03:58","date_gmt":"2026-04-17T11:03:58","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/"},"modified":"2026-04-17T11:03:58","modified_gmt":"2026-04-17T11:03:58","slug":"mythos-and-cybersecurity","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/","title":{"rendered":"Mythos and Cybersecurity"},"content":{"rendered":"
\n

Last week, Anthropic pulled back the curtain on Claude Mythos Preview<\/a>, an AI model so capable at finding and exploiting software vulnerabilities that the company decided<\/a> it was too dangerous to release to the public. Instead, access has been restricted<\/a> to roughly 50 organizations\u2014Microsoft, Apple, Amazon Web Services, CrowdStrike and other vendors of critical infrastructure\u2014under an initiative called Project Glasswing<\/a>.<\/p>\n

The announcement was accompanied by a barrage of hair-raising anecdotes: thousands<\/a> of vulnerabilities uncovered across every major<\/a> operating system and browser, including a 27-year-old bug in OpenBSD, a 16-year-old flaw in FFmpeg. Mythos was able to weaponize a set of vulnerabilities it found in the Firefox browser into 181 usable attacks; Anthropic\u2019s previous flagship model could only achieve two.<\/p>\n

This is, in many respects, exactly the kind of responsible disclosure that security researchers have long urged. And yet the public has been given remarkably little with which to evaluate Anthropic\u2019s decision. We have been shown a highlight reel of spectacular successes. However, we can\u2019t tell if we have a blockbuster until they let us see the whole movie.<\/p>\n

For example, we don\u2019t know how many times Mythos mistakenly flagged code as vulnerable. Anthropic said security contractors agreed with the AI\u2019s severity rating 198 times, with an 89 per cent severity agreement. That\u2019s impressive, but incomplete. Independent researchers examining similar models have found that AI that detects nearly every real bug also hallucinates plausible-sounding vulnerabilities in patched, correct code.<\/p>\n

This matters. A model that autonomously finds and exploits hundreds of vulnerabilities with inhuman precision is a game changer, but a model that generates thousands of false alarms and non-working attacks still needs skilled and knowledgeable humans. Without knowing the rate of false alarms in Mythos\u2019s unfiltered output, we cannot tell whether the examples showcased are representative.<\/p>\n

There is a second, subtler problem. Large language models, including Mythos, perform best on inputs that resemble what they were trained on: widely used open-source projects, major browsers, the Linux kernel and popular web frameworks. Concentrating early access among the largest vendors of precisely this software is sensible; it lets them patch first, before adversaries catch up.<\/p>\n

But the inverse is also true. Software outside the training distribution\u2014industrial control systems, medical device firmware, bespoke financial infrastructure, regional banking software, older embedded systems\u2014is exactly where out-of-the-box Mythos is likely least able to find or exploit bugs.<\/p>\n

However, a sufficiently motivated attacker with domain expertise in one of these fields could nevertheless wield Mythos\u2019s advanced reasoning capabilities as a force multiplier, probing systems that Anthropic\u2019s own engineers lack the specialized knowledge to audit. The danger is not that Mythos fails in those domains; it is that Mythos may succeed for whoever brings the expertise.<\/p>\n

Broader, structured access for academic researchers and domain specialists\u2014cardiologists\u2019 partners in medical device security, control-systems engineers, researchers in less prominent languages and ecosystems\u2014would meaningfully reduce this asymmetry. Fifty companies, however well chosen, cannot substitute for the distributed expertise of the entire research community.<\/p>\n

None of this is an indictment of Anthropic. By all appearances the company is trying to act responsibly, and its decision to hold the model back is evidence of seriousness.<\/p>\n

But Anthropic is a private company and, in some ways, still a start-up. Yet it is making unilateral decisions about which pieces of our critical global infrastructure get defended first, and which must wait their turn.<\/p>\n

It has finite staff, finite budget and finite expertise. It will miss things, and when the thing missed is in the software running a hospital or a power grid, the cost will be borne by people who never had a say.<\/p>\n

The security problem is far greater<\/a> than one company and one model. There\u2019s no reason to believe that Mythos Preview is unique. (Not to be outdone, OpenAI announced<\/a> that its new GPT-5.3-Codex is so dangerous that the model also will not be released to the general public.) And it\u2019s unclear how much of an advance these new models represent. The security company Aisle was able to replicate<\/a> many of Anthropic\u2019s published anecdotes using smaller, cheaper, public AI models.<\/p>\n

Any decisions we make about whether and how to release these powerful models are more than one company\u2019s responsibility. Ultimately, this will probably lead to regulation. That will be hard to get right and requires a long process of consultation and feedback.<\/p>\n

In the short term, we need something simpler: greater transparency and information sharing with the broader community. This doesn\u2019t necessarily mean making powerful models like Claude Mythos widely available. Rather, it means sharing as much data and information as possible, so that we can collectively make informed decisions.<\/p>\n

We need globally co-ordinated frameworks for independent auditing, mandatory disclosure of aggregate performance metrics and funded access for academic and civil-society researchers.<\/p>\n

This has implications for national security, personal safety and corporate competitiveness. Any technology that can find thousands of exploitable flaws in the systems we all depend on should not be governed solely by the internal judgment of its creators, however well intentioned.<\/p>\n

Until that changes, each Mythos-class release will put the world at the edge of another precipice, without any visibility into whether there is a landing out of view just below, or whether this time the drop will be fatal. That is not a choice a for-profit corporation should be allowed to make in a democratic society. Nor should such a company be able to restrict the ability of society to make choices about its own security.<\/p>\n

This essay was written with David Lie, and originally appeared in The Globe and Mail<\/a>.<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Last week, Anthropic pulled back the curtain on Claude Mythos Preview, an AI model so capable at finding and exploiting software vulnerabilities that the company decided it was too dangerous to release to the public. Instead, access has been restricted to roughly 50 organizations\u2014Microsoft, Apple, Amazon Web Services, CrowdStrike and other vendors of critical infrastructure\u2014under […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[4,90,210,53,242],"tags":[91],"class_list":["post-2565","post","type-post","status-publish","format-standard","hentry","category-ai","category-cybersecurity","category-llm","category-uncategorized","category-vulnerabilities","tag-cybersecurity"],"yoast_head":"\nMythos and Cybersecurity - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mythos and Cybersecurity - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"Last week, Anthropic pulled back the curtain on Claude Mythos Preview, an AI model so capable at finding and exploiting software vulnerabilities that the company decided it was too dangerous to release to the public. Instead, access has been restricted to roughly 50 organizations\u2014Microsoft, Apple, Amazon Web Services, CrowdStrike and other vendors of critical infrastructure\u2014under […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-17T11:03:58+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Mythos and Cybersecurity\",\"datePublished\":\"2026-04-17T11:03:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/\"},\"wordCount\":940,\"keywords\":[\"Cybersecurity\"],\"articleSection\":{\"0\":\"AI\",\"1\":\"Cybersecurity\",\"2\":\"LLM\",\"4\":\"Vulnerabilities\"},\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/\",\"name\":\"Mythos and Cybersecurity - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"datePublished\":\"2026-04-17T11:03:58+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mythos and Cybersecurity\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Mythos and Cybersecurity - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/","og_locale":"en_US","og_type":"article","og_title":"Mythos and Cybersecurity - Imperative Business Ventures Limited","og_description":"Last week, Anthropic pulled back the curtain on Claude Mythos Preview, an AI model so capable at finding and exploiting software vulnerabilities that the company decided it was too dangerous to release to the public. Instead, access has been restricted to roughly 50 organizations\u2014Microsoft, Apple, Amazon Web Services, CrowdStrike and other vendors of critical infrastructure\u2014under […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-04-17T11:03:58+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Mythos and Cybersecurity","datePublished":"2026-04-17T11:03:58+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/"},"wordCount":940,"keywords":["Cybersecurity"],"articleSection":{"0":"AI","1":"Cybersecurity","2":"LLM","4":"Vulnerabilities"},"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/","name":"Mythos and Cybersecurity - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"datePublished":"2026-04-17T11:03:58+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/17\/mythos-and-cybersecurity\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Mythos and Cybersecurity"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/2565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=2565"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/2565\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=2565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=2565"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=2565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}