Anthropic's AI: Accelerating Exploits Faster Than Ever

In a startling revelation, Anthropic's Mythos Preview AI can now transform known software vulnerabilities into actionable exploits in mere hours. This revelation, shared with Axios, indicates that AI isn't just about finding new bugs. It's equally about weaponizing existing ones at breakneck speed.

The Numbers Speak

Anthropic's frontier red team put Mythos to the test on vulnerabilities found in Mozilla Firefox and the Microsoft Windows kernel. These bugs were disclosed in January and February, and the results were stunning. Within just 31 minutes, Mythos produced a proof-of-concept exploit for a Windows kernel vulnerability. Of the 21 kernel bugs tested, it caused the infamous "blue screen of death" 18 times. Mythos didn't stop there. It created 8 unique exploits, with the longest one taking about 5.7 hours. On the Firefox front, Mythos turned 18 security patches into 8 working code-execution exploits.

Why Should We Care?

Here's where it gets tricky. Most cyberattacks today aren't from unknown threats but from vulnerabilities that are already on the radar. But here's the catch. Patching isn't a simple drag-and-drop solution. IT teams need to test, and many fixes require downtime. So, the real question is, are we prepared for AI that can outpace our defenses?

Beyond Mythos

Mythos isn't the only player in this game. Open-source models are hot on its heels, finding bugs as effectively as Mythos and OpenAI's GPT-5.5-Cyber. Anthropic estimates that Mythos generated its Windows privilege-escalation exploits for about $15,700 in API credits. That's roughly $2,000 per exploit. But who benefits from this efficiency? And at what cost?

Policy on the Horizon

The Trump administration is taking note. A new AI security executive order is in the works, aiming to evaluate the national security risks posed by these advanced AI models. But will it be enough to curb potential misuse? Or are we merely playing catch-up in a game where AI holds all the cards?

As technology barrels forward, we must ask ourselves: Whose data? Whose labor? Whose benefit? The benchmark doesn't capture what matters most when lives and security are on the line.