Claude Mythos Turns Years of Security Research into 20-Hour AI Exploits

Anthropic's newly announced Claude Mythos AI model has triggered significant concern among global financial and security leaders due to its autonomous capability to discover and exploit software vulnerabilities. In tests conducted by the UK's AI Security Institute (AISI), Mythos successfully executed a complex 32-step corporate network attack, achieving full system takeover in approximately 20 hours—a task that typically requires significantly more time for human professionals. The model identified thousands of high-severity flaws across major operating systems and browsers, including a decades-old vulnerability in OpenBSD. However, experts note these results were achieved in controlled lab environments lacking active defenses or sandboxing. Despite these limitations, the AISI warns that offensive AI capabilities are doubling every four months, suggesting an urgent need for defensive adaptation. The report highlights that performance scales with compute resources, implying that attackers with sufficient token budgets can continuously find new exploits. This development has prompted open letters from the UK government to business leaders and discussions at the IMF, signaling a pivotal shift in cybersecurity dynamics where AI-driven attacks may outpace traditional human-led defense mechanisms.