Experts: Anthropic’s move to expand Project Glasswing will end in Mythos public release
Anthropic is expanding access to its flagship Project Glasswing and powerful Mythos AI model to an additional 150 partners in more than 15 countries. This signals that the company is preparing for the model’s public release – and that the hard part is just beginning.
-
Anthropic’s wider Glasswing rollout signals Mythos is moving steadily toward an eventual public release.
-
Mythos may uncover more vulnerabilities, but patching and remediation remain the bigger challenge.
-
Experts say organizations that pair AI findings with human expertise will benefit most.
Mythos, the model that has reportedly proven adept at finding software vulnerabilities, will expand into industries that weren’t well represented in the initial launch in early April, such as power, water, healthcare, communications, and hardware.
“This expansion is the next step toward our long-term goals: for AI to make all software more secure, and for us to help the industry adjust to how AI could change many of the core assumptions of cybersecurity,” Anthropic said in a blog post.
A lot of help, a lot of challenges
Initially, roughly 50 partners had access to Claude Mythos Preview, and each new partner will need to meet Anthropic’s security requirements before they gain access to the model.
“What each partner has in common is that a successful attack on their codebase could be catastrophic,” said the startup.
“For most partners, we estimate that a major attack could affect more than 100 million people, with important ramifications for both global and national security.”
That’s, of course, the usual fearmongering, typical for AI cheerleaders. Cybersecurity researchers recently said that early fears that Mythos could turbocharge hacking were overstated.
And soon after the model’s initial limited release, Marcus Hutchins, the US-based British malware analyst and cybersecurity researcher, best known for helping stop the global WannaCry ransomware attack, said there was no evidence yet that AI systems were more cost-effective than human researchers in terms of value per vulnerability discovered.
Check if your data has been leaked
Finally, even if Mythos really is catching thousands of critical vulnerabilities, developers aren’t really happy since they’re now flooded with work and can’t keep up with all the AI-written bug reports.
The relative ease of finding vulnerabilities compared with the difficulty of fixing them indeed amounts to a major challenge for cybersecurity.
The hard part is now
Still, experts are glad Anthropic is expanding the project. According to Joe Saunders, founder and CEO of RunSafe Security, that’s a much-needed step for the critical organizations that keep societies running.
“Power, water, healthcare, communications, and hardware providers all depend on software that is complex, widely connected, and often difficult to patch quickly,” said Saunders.
“The organizations that benefit most from these advances will be the ones that can rapidly validate, prioritize, and remediate the issues being discovered before attackers find them first,”
Gunter Ollmann.
“Early access to Mythos gives organizations an opportunity to improve software visibility, harden vulnerable systems, and modernize their response workflows as AI-driven security tools become more common.”
Jim Sherlock, VP of AI & Cybersecurity R&D at ProCircular, says this is the “next step on a road that ends in Mythos’ public release.”
“Anthropic is essentially rehearsing the general rollout of Mythos, one controlled cohort at a time, and watching whether it can widen access without the whole thing blowing up. The rest of us are still outside the club, with general access locked until safeguards exist that nobody, Anthropic included, has actually built yet,” explains Sherlock.
“But as Anthropic itself reiterated, this capability is coming to everyone sooner rather than later. They’re on record stating that comparable models will be landing in other hands within six to twelve months, possibly with no guardrails at all.”
Sherlock, however, agrees that the hard part now is patching and deploying at scale: “It happens to be the thing most mid-market shops are flat out bad at.”
His advice for companies? To fix whatever’s bad before the flood, not during it.
“AI isn’t replacing security experts. The combination of AI-driven analysis and human expertise is proving far more effective than either operating alone,” adds Gunter Ollmann, CTO at Cobalt.
“The organizations that benefit most from these advances will be the ones that can rapidly validate, prioritize, and remediate the issues being discovered before attackers find them first.”
Unlock more exclusive Cybernews content on YouTube.
