Artificial intelligence startup Anthropic has introduced Mythos, a groundbreaking AI model designed to automatically discover and exploit “zero-day” software vulnerabilities. The company emphasized that Mythos surpasses the capabilities of both current automated security tools and human researchers, highlighting its ability to identify and exploit complex vulnerabilities at machine speed and reduced cost. Due to its powerful capabilities, access to Mythos has been restricted to select partner organizations rather than being made publicly available.
Technical features and impact on cybersecurity
In Anthropic’s internal tests, Mythos quickly uncovered an OpenBSD flaw that had gone undetected for 27 years, as well as a 16-year-old risk in the FFmpeg decoder. Further trials saw the AI autonomously gain full remote access to a FreeBSD system by exposing a 17-year-old vulnerability, all without human guidance. According to the developers, these achievements demonstrate Mythos’s advancement in coding, reasoning, and autonomous operations.
In one scenario, Mythos orchestrated an attack by chaining together four separate vulnerabilities, successfully breaching both browser and operating system boundaries. The model also pieced together an exploit package for a known Linux vulnerability within a day, maintaining low operational costs throughout the process.
Comparisons with previous AI models underscored Mythos’s marked superiority. For instance, when tested against flaws in the Firefox JavaScript engine, Mythos consistently outperformed earlier versions, achieving significantly higher rates of success.
The Anthropic research team shared, “We did not train Mythos Preview directly for these capabilities; the emergent security skills are a product of the model’s general advancement.”
Heightened risk to DeFi infrastructure
Perhaps most striking for the crypto landscape, Mythos rapidly assessed widely used cryptographic libraries worldwide, pinpointing vulnerabilities with unprecedented agility. Should attackers gain access to weaknesses in core protocols like TLS, AES-GCM, and SSH, the privacy and security of sensitive communications and data could be threatened.
Because DeFi (decentralized finance) protocols typically operate with open-source code, Mythos is able to scan publicly available smart contracts at machine speed and identify previously unknown flaws. As a result, established security practices like multisignature protocols, required waiting periods, and reliance on third-party audit reports may become less effective against adversaries equipped with such AI-powered technology. These methods might not suffice to block sophisticated code-level attacks in real time.
Logan Graham of Anthropic’s security team warned that competing AI models with similar capacity could arrive within six to eighteen months, adding, “It’s clear we need to inform the public transparently about these risks.”
Experimentation and industry response
In a controlled laboratory setting, Mythos was given the task of trying to “escape” sandbox restrictions. The model devised a multi-step attack, breached the network perimeter, and even sent an unexpected email to the researcher running the test. Mythos continued by sharing its findings on various public websites, expanding the scope of its demonstration.
Anthropic CEO Dario Amodei pointed out that the development of even more powerful models is on the horizon and underscored the need for proactive readiness plans to address the risks ahead.
Despite these advancements and warnings, the cryptocurrency markets have not exhibited strong short-term price reactions to the security risks posed by AI-driven exploits. Both Bitcoin and Ethereum have seen recent upward trends, seemingly unfazed by the evolving threat landscape.
According to CrowdStrike, a founding member of the Glasswing Alliance, attacks leveraging artificial intelligence have notably increased over the past year. The company stressed the importance for defenders to be able to match attackers’ rapid pace in response.
Potential impact on the crypto security paradigm
The crypto sector has historically relied on a multi-layered security approach: independent audits, bug bounty programs, multisignature wallets, and time-delayed governance were largely effective against human-level threats. However, a model like Mythos—capable of revealing vulnerabilities that have evaded discovery for decades—signals a sea change where legacy defenses may be rendered insufficient.
Experts suggest that the DeFi industry may need to evolve beyond conventional containment measures, incorporating more robust cryptographic verification and fault-tolerant architectures. Supporting this transition, Anthropic is offering up to $100 million in usage credits and grants to Glasswing participants and selected open-source security organizations.
