In this commentary, Matthew Rosenquist warns that Anthropic's new AI model, Mythos (also referred to as Methos), is poised to fundamentally disrupt cybersecurity. The model has already uncovered thousands of previously unknown vulnerabilities—including a 27‑year‑old flaw—in commercial and open‑source software during a limited internal scan. When Mozilla used Mythos on Firefox, it found 271 new bugs beyond the 22 identified by Anthropic’s prior model, Opus 4.6. Extrapolating from 2025’s 50,000 discovered flaws, widespread access to Mythos could yield over 600,000 new vulnerabilities in a year. Mythos excels at three capabilities: rapid, deep vulnerability discovery; automated exploit generation; and vulnerability chaining that creates complex attack paths, enabling full attack orchestration at machine speed. This accelerates the timeline from discovery to exploitation from years to hours or minutes, rendering traditional patch cycles like Microsoft’s monthly Patch Tuesday ineffective. The ripple effects touch every stakeholder—software developers, security researchers, incident responders, patch engineers, crisis managers, vendors, and critical‑infrastructure operators (healthcare, power, telecom, finance). High‑level actors such as Wall Street firms and the White House have already expressed concern. Rosenquist argues defenders must adopt AI tools themselves to proactively discover and mitigate threats, detect exploit activity in real time, and shift to continuous, possibly multiple‑times‑daily, patching. He frames Mythos not as an isolated incident but as a signal of a broader AI‑driven shift that will force the entire security industry to evolve rapidly.
Chapters
Methos is Anthropic's latest AI model, and it's stirring up a tornado of concern in cybersecurity circles. Here is what you need to know, why it matters long-term, and what the industry is not talking about. Even before its release, Methos discovered thousands of new sensitive vulnerabilities in commercial and open-source software, including all major operating systems and web browsers. One was in existence for over 27 years without the industry noticing. Based on what it found, Anthropic felt it was so potentially dangerous it throttled the initial release to a very limited number of close partners. This initial scan was conducted in-house by Anthropic in a very short time, evaluating a limited number of systems, and not a result of having the global community of developers and vulnerability researchers use the tool. Nobody has been willing to estimate what that would look like, but it will likely be orders of magnitude more than is currently discovered. One of the partners, Mozilla, used Mythos to evaluate their popular Firefox browser. Anthropic's current model, Opus 4.6, identified 22 security-sensitive bugs in the previous version that were patched. Mythos identified an additional 271 bugs. At that rate, if we extrapolate the number of vulnerabilities discovered in 2025, and that was about 50,000, we would expect to see over 600,000 vulnerabilities discovered in the 12 months following the widespread accessibility of Metos. The industry does not currently understand the downstream impacts of that scale, and the problem does not end with the vulnerabilities. Methos excels at 3 things. First, vulnerability discovery. It does it faster, deeper, and across the stacks. Second is exploit creation, the automatic creation of hacks that previously required human guidance and a lot of time. And third is vulnerability chaining, stitching together lesser vulnerabilities in ways humans can't easily comprehend. And as always with this model and, and others, there is the capability of attack orchestration, and that essentially automates the hacking at machine speed when the attacker wants to exploit victims. So who is concerned? Everyone. Software developers, cybersecurity, every industry, including critical infrastructures like healthcare, telecommunications, transportation, and power. Recently, the heads of top Wall Street finance firms met to discuss how Mythos may put global banking at risk. The White House called in Anthropic to discuss the risks. And let me be clear, Anthropic is not a security company. They are a brilliant AI company. So what are the cybersecurity companies who had early access saying? They too are very concerned. So why is it a problem? Well, the speed of vulnerability discovery will shrink to a small fraction of what it is now. The number of vulnerabilities discovered will rise sharply. Exploits will be created very soon after discovery for all of them, not just a select few. And more zero-day attacks will happen. Tying up security operations, crisis response, digital forensics, and incident response This doesn't just put pressure on developers, it crushes their process system for patching. Take for example Microsoft's Patch Tuesday, which occurs on the second Tuesday of every month. This cadence reflects a balance between the time it takes to validate a vulnerability, prepare and test a patch, and deploy it to the customers versus the time it takes for the attackers to build an exploit for the vulnerability and then use it against the victims. There is a window of time, about a month, that Microsoft has to manage this risk. But if AI models like Mythos can find a vulnerability, create an exploit, and attack victims in hours or days, this entire operating model becomes too slow and ineffective. The time to exploit, which is the gap between vulnerability announcement and exploitation, is dramatically decreasing. From years to hours and soon to minutes. This is the window where patching must occur to be effective. This impacts everyone. Developers when they design, build, and test products before they are released and all the future updates. Vulnerability researchers, both the ethical and unethical, including those that sit in the gray area. Security operations, as more exploitations emerge, they must be detected and mitigated. Then there's the patch developers, the quality and assurance teams, and the deployment teams. A dramatic increase in overseeing the number of reported vulnerabilities, which means the validation, the comprehension of what those vulnerabilities are, patch creation, testing, and development takes time and effort, and many of these people are the ones building the next products or features. Then there's crisis management. More exploitations result in crisis events and all the work needed to understand and remediate them, including digital forensics. And then we have to think about the partners, the suppliers, vendors, customers, and end users. There are third-party risks that increase in relation to the number of vulnerabilities and exploits that partners may be affected by. The last is national critical infrastructures, and that impacts us all. The most sophisticated and powerful attackers, those sponsored or run by nations, will have access to these models and resources to use them in their attacks against adversaries' critical infrastructures like power, water, telecommunications, shipping, logistics, and government services. This shows the percentage of vulnerabilities that were exploited on or before the date of disclosure, and it highlights the race that security is losing. So adaptation is absolutely required. Defenders must adopt AI tools as fast as possible. They need to use AI to proactively find the vulnerabilities before researchers so that they can be remediated. They have to adopt AI tools to detect when new vulnerabilities are being exploited in the wild to trigger a rapid response. And AI solutions will need to develop, test, and deploy effective patches in potentially suboptimal operating conditions. Executive leadership must realize with the window shrinking between vulnerability discovery and exploit, patching won't be a monthly exercise, instead moving closer to a continuously updating model, perhaps multiple times a day in the future, which can cause business disruption, customer dissatisfaction, and other issues if not addressed at the architectural levels. And this is only the beginning. Mythos is not an event, but rather a signal of change. It's not a single problem that the technology industry must come to terms with, but rather a vector of how AI's accelerating vulnerability and exploit capabilities will undermine current cybersecurity norms and practices. Other AI models are racing to provide similar or better capabilities, and all of them will continue to advance, likely at even a faster pace, forcing cybersecurity to adapt at the same rate to remain effective. Methos has not just accelerated vulnerability discovery, but rather it has crushed the foundations on how we manage and make decisions regarding the protection and trust of digital systems. Digital security must now transform its adaptive capabilities so it can keep pace, and nobody yet knows how exactly to do that.
