🧠 Food for thought

Implications, context, and why it matters.

### The model can autonomously find and exploit decades-old software flaws

• Claude Mythos Preview can find vulnerabilities and build working exploits without human help 1.
• It produced a remote code execution exploit, which lets an attacker run code on another machine, for a 17-year-old flaw in FreeBSD’s NFS server, a file-sharing service built into the operating system kernel 1.
• It also uncovered a separate bug in OpenBSD, an open-source operating system, that had gone unnoticed for 27 years 1.
• Anthropic says these skills were not directly trained and came from broader gains in coding and reasoning. The run that found the OpenBSD bug cost under $50, though Anthropic says that number “only makes sense with full hindsight” 1.

### The era of automated exploit generation changes the rules for everyone

• AI that quickly turns vulnerability disclosures into working exploits makes the monthly patch cycle, the routine schedule many companies use to install security fixes, too slow for many threats 1.
• This shift can widen the pool of capable attackers since work once reserved for elite cybersecurity teams becomes easier to reproduce 1.
• The model is currently limited to Project Glasswing, Anthropic’s controlled testing program, with access through Amazon Bedrock, Amazon’s cloud service for building with foundation models, in a gated research preview 2.
• US officials have urged systemically important banks, meaning large financial institutions whose disruption could threaten the wider financial system, to use the model to hunt flaws in their own systems before attackers do 3.