AI Cybersecurity Tool Raises Both Promise and Concern Among Experts

WASHINGTON — A powerful new artificial intelligence model is drawing attention in the tech and cybersecurity world — not just for what it can do, but for how it could be used if it falls into the wrong hands.

Anthropic, one of the leading AI firms, is developing an experimental system known as “Mythos.” Unlike consumer-facing AI tools, this model is not publicly available. Instead, it’s being quietly tested with a small group of major companies due to concerns over its capabilities.

The system is designed specifically for cybersecurity applications, with Anthropic reporting that it has already identified thousands of high-severity software vulnerabilities, including flaws in widely used operating systems and web browsers.

Perhaps more concerning, the system has demonstrated the ability to identify and exploit “zero-day” vulnerabilities — previously unknown weaknesses that can be especially dangerous if discovered by malicious actors before developers have a chance to patch them.

Independent testing by the UK AI Security Institute has underscored both the promise and potential risks of Mythos. Evaluators found the model succeeded in expert-level cybersecurity challenges approximately 73% of the time and, in certain scenarios, could carry out complex, multi-step simulated cyberattacks from start to finish without human guidance.

However, these tests were conducted in controlled environments — not against real-world, highly defended systems — making it difficult to fully assess how effective such a tool might be in actual attack scenarios.

Because of these capabilities, Anthropic has taken a deliberately cautious approach to deployment. Rather than releasing Mythos publicly, access is strictly limited to a select group of major tech firms, including Google, Amazon, Apple, and Microsoft. The goal is to test the system’s capabilities while minimizing the risk of misuse.

“Tools like this represent a significant advance in what AI can do in cybersecurity,” said Dr. Eliza Chen, a cybersecurity researcher at Stanford University who was not involved in developing Mythos. “The challenge is that any technology that can find vulnerabilities more efficiently can be used both defensively and offensively.”

Anthropic has also launched “Project Glasswing,” an initiative focused on using advanced AI capabilities for defensive cybersecurity purposes only. As part of that effort, participating firms are conducting extensive “red teaming” exercises, where security experts attempt to break the system and uncover potential vulnerabilities before any wider rollout is considered.

The companies claim they are monitoring how these tools are used in real time — with the ability to immediately shut down access if abuse is detected. Industry insiders suggest these safeguards include systems that monitor for patterns of use that might indicate malicious intent.

The development comes amid a growing global cybersecurity threat landscape. Cyberattacks have increased significantly in recent years, targeting everything from hospitals and municipal governments to critical infrastructure and defense systems.

In a recent example highlighting ongoing vulnerabilities, hackers linked to Iran reportedly accessed emails connected to FBI Director Kash Patel. While officials stated no sensitive information was exposed, the incident underscores the persistent threat environment that security professionals face.

Security researchers warn that advanced AI could make these threats even more dangerous by allowing attackers to identify weaknesses faster and carry out more sophisticated operations with fewer resources. This could potentially level the playing field between nation-state actors and smaller hacking groups.

In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) leads efforts to defend against such threats. The agency is responsible for protecting critical infrastructure, including power grids, election systems, and financial networks.

However, significant challenges remain. Recent congressional hearings have raised concerns about staffing and resource constraints, prompting questions about whether current defenses can keep pace with rapidly evolving threats — especially as AI enters the equation.

“We’re at a critical juncture where the development of AI for cybersecurity must include robust safeguards,” said Mark Thompson, former cybersecurity advisor to the Department of Homeland Security. “The technology that helps us defend systems can also help attackers breach them if it falls into the wrong hands.”