April AI Reality Check

In early April, Anthropic, the makers of the Claude models and chatbot, announced that they had developed a new AI model, code-named “Mythos,” that was significantly better at software coding than earlier models.  As a side effect of being a great coder, they were so good at hacking that they weren’t releasing it to the public. This model found thousands of vulnerabilities in well-established, highly secure software, as well as much of the software we use today. In the short term, they’ve released it to cloud providers and cybersecurity companies to harden their systems. 

AI models follow a familiar pattern - the best of the best are usually 3-9 months ahead of freely available models, including those from China. This means that by the end of the year, it is reasonable to expect that bad actors will have access to tools like this. 

This matters not just because the models can find vulnerabilities only the best humans can - it matters because they find them fast, and can apply an army of AI agents to overwhelm the problem, doing in hours or days what a nation-state like Iran or China would need months or longer to achieve.

This means we’re entering a new phase of cybersecurity, where everyone needs to make it a priority again, at least for a time. Mythos is still locked up for now, and we’re already seeing cybersecurity firms offering to use it or similar to harden systems. 

In an industry where ransomware is more common than most realize, this new phase of cyber threats is a time to invest in both internal and external resources to protect your business, customers, and the people involved with your company.