What Anthropic’s Claude Mythos means for your organisation’s cyber risk and what to do about it before attacker’s act.
On 7 April 2026, Anthropic announced Claude Mythos Preview, a general-purpose AI model that has demonstrated the ability to autonomously discover and exploit software vulnerabilities at a scale and speed not seen before.
In internal testing, Mythos identified thousands of previously unknown vulnerabilities across every major operating system and web browser, including flaws that had survived decades of human security review. Engineers with no formal security training were able to produce working exploits using a prompt that amounted to: find a vulnerability in this programme.
Anthropic has restricted access to a controlled group of industry partners through Project Glasswing, which includes Microsoft, Google, Amazon and Cisco, precisely because the capability is considered too significant for general release at this stage.
The concern for businesses is not simply that AI will create more attacks; it is that AI makes existing attack paths far easier and faster to find. That changes the risk equation for every organisation operating digital infrastructure.
Most organisations were designed for a threat environment where defenders had time:
That time is now significantly reduced.
AI-powered vulnerability discovery compresses the timeline between a weakness existing and an attacker becoming aware of it. At scale, it also overwhelms traditional remediation capacity. The Edgescan Vulnerability Statistics Report 2025 already shows that over 45% of vulnerabilities discovered in large organisations remain unpatched after 12 months. Mythos-class tools do not wait 12 months.
|
Old Threat Environment |
AI-enabled Threat Environment |
|
Months between discovery and exploitation |
Hours between discovery and exploitation |
|
Skilled attackers required to find zero-days |
Engineers with no security training can generate working exploits |
|
Annual Pen Test captures a point-in-time view |
Continuous discovery means the attack surface is never static |
|
Patching backlog is manageable with monthly cycles |
Volume of AI-discovered vulnerabilities overwhelms patch capacity |
|
Defenders and attackers operate at similar speeds |
Attackers gain an asymmetric advantage from automation |
The reality is simple: today's threat environment demands more than periodic reviews and reactive remediation.
"If Anthropic's Claude Mythos is even half as effective as early reports suggest, the cyber security landscape is about to undergo a monumental shift once capabilities like this are weaponised by threat actors. Mythos is only the first of a new generation of highly advanced, cyber security-focused AI models capable of accelerating cyber attacks at unprecedented speed and scale. OpenAI's Daybreak being another. It is clear, the pace of change is now AI-powered."
- Luke Elston, Microsoft Practice Director
This is not a question for the IT team alone, cyber risk at this speed is a business continuity question, a regulatory question and a reputational question. If you are a board member, executive or senior leader, these are the questions worth asking this week:
If any of those answers are unclear, the organisation has exposure it may not be able to quantify yet, which is the risk Mythos makes visible.
Mythos does not create new categories of vulnerability. It finds weaknesses that already exist, faster and at greater scale than was previously possible. That means the organisations with the greatest exposure are those that already have gaps they have not closed.
The highest-risk areas in most organisations are:
For regulated sectors including financial services, healthcare, legal, utilities and public sector, the stakes are compounded by regulatory obligations. Cyber security can no longer be treated as a compliance exercise. It has to operate as a continuous, intelligence-led discipline.
"Claude Mythos is a signal that the security industry cannot afford to ignore. When AI can discover and chain together exploitable vulnerabilities faster than most organisations can patch them, the traditional model of periodic reviews and annual penetration tests is no longer fit for purpose. This is not a technology problem — it is a business continuity, regulatory and reputational question that belongs at board level. The organisations that respond well will be those that move now to continuous monitoring, faster remediation and an integrated security model. The ones that wait will find out the hard way that attackers do not observe annual review cycles."
- Dominic List, CEO & Founder
The risk is not evenly distributed. Some sectors face a significantly higher threat due to a combination of high attacker interest, complex legacy environments and slower remediation cycles.
Most cyber security conversations focus on ransomware and data theft. The Mythos capability introduces a more significant risk for government, defence and regulated sectors: covert persistent access.
A hostile state using Mythos-class capability does not need to launch a visible attack. It needs to accelerate reconnaissance, discover exploitable weaknesses quietly and establish a foothold that goes undetected. The goal is persistent access to government networks, defence contractor systems, policy intelligence, citizen datasets and critical infrastructure — not immediate disruption, but leverage for future use.
For organisations in those sectors, continuous monitoring and rapid detection are not just operational disciplines. They are the primary defence against a threat that may already be present and is not designed to announce itself.
It is important not to read Mythos as a purely negative development. The same capability that accelerates attacker discovery also helps defenders find and fix vulnerabilities before those attackers do. Mozilla reportedly used Mythos Preview to identify 271 Firefox vulnerabilities, which were then patched. Project Glasswing exists precisely to give defenders a structured head start.
The strategic question is whether your organisation has the operational maturity to act on what AI-assisted discovery surfaces. Finding thousands of issues is not useful if the business cannot prioritise, validate and remediate at pace. The defensive advantage only materialises for organisations that have already built the infrastructure to use it.
The right response to Mythos is not a new tool purchase or an urgent board presentation. It is a structured shift in how security operates day-to-day.
Organisations that will manage this environment best are those that combine continuous monitoring, fast remediation, operational depth and executive visibility, working together as one integrated function rather than separate disciplines that connect only when something goes wrong.
Improve Network Segmentation: One compromised system should not mean full network access. Segmentation limits the blast radius of an attack and is one of the most effective controls against lateral movement by an attacker that has already gained an initial foothold.
CyberOne is a Microsoft Security Elite Partner, with services are built for exactly the kind of continuous, integrated security model that the Mythos environment demands.
Through our SNOC (Security and Network Operations Centre) model, we bring security monitoring, threat detection, network operations and incident response into one aligned team. That means when a threat is identified, the right expertise is already in place to investigate, contain and remediate without delay or unnecessary handoffs to disconnected providers.
CyberOne help organisations:
If you want to understand where your organisation stands today, how your Microsoft environment is configured, where your greatest exposure lies and what needs to change, our team can help you assess that clearly and practically.
Mythos does not create a theoretical future risk. It reflects a capability that exists now, is already being evaluated by the world’s largest technology organisations and will become more widely available over time.
The organisations that respond well will be those that treat this as the operational signal it is: time to move from periodic security to continuous resilience, from reactive response to integrated detection and containment.
The organisations most exposed will be those that file this under ‘something to monitor’ and return to it at the next annual review.