Sign up to save your podcasts
Or
Share Project Mythos & AI's Zero-Day Edge
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Project Mythos & AI's Zero-Day Edge
On April 7, Scott Bessent and Jerome Powell pulled the CEOs of the biggest U.S. banks into Treasury for an urgent, closed-door briefing — not about rates, not about liquidity, but about an AI model. Anthropic’s Claude Mythos Preview is apparently an order of magnitude better than anything currently public at finding software vulnerabilities. Rather than release it, Anthropic built a consortium called Project Glasswing and gave the major platform companies early access to patch before the capability proliferates. The warning shot landed loud: Mozilla used Mythos to find and fix 271 previously unknown vulnerabilities in Firefox 150. On the prior version, Anthropic’s best publicly available model had surfaced 22.
That’s a one-version jump from a couple dozen to several hundred. When a process improves by an order of magnitude overnight, you pay attention. The reason policymakers are rattled isn’t that Mythos will suddenly own your bank account tomorrow — Anthropic is keeping the model caged, and non-state actors can’t train their own. The fear is the gap period: a stretch of months where a Mythos-class capability exists, hasn’t been fully used for defense yet, and could be replicated by a nation-state adversary with the means and the motive. China can probably build one. Iran and Russia probably can’t — yet. Whichever side gets through the world’s legacy open-source libraries first owns the window.
The underappreciated story is that this round of the offense-defense arms race may actually tip toward the defense. Mythos didn’t find bugs an elite human researcher couldn’t have caught; it just did it at machine speed and machine scale. Applied to new code, that points at a future where shipped software arrives without the kind of rotten foundations that made Equifax, NotPetya, and every critical-infrastructure nightmare possible. The catch is that the patching has to get done before the capability gets out. Glasswing is supposed to run through the summer. That’s the runway.
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit globaltantrum.substack.com
View all episodes
By Steve Palley, Galen JacksonOn April 7, Scott Bessent and Jerome Powell pulled the CEOs of the biggest U.S. banks into Treasury for an urgent, closed-door briefing — not about rates, not about liquidity, but about an AI model. Anthropic’s Claude Mythos Preview is apparently an order of magnitude better than anything currently public at finding software vulnerabilities. Rather than release it, Anthropic built a consortium called Project Glasswing and gave the major platform companies early access to patch before the capability proliferates. The warning shot landed loud: Mozilla used Mythos to find and fix 271 previously unknown vulnerabilities in Firefox 150. On the prior version, Anthropic’s best publicly available model had surfaced 22.
That’s a one-version jump from a couple dozen to several hundred. When a process improves by an order of magnitude overnight, you pay attention. The reason policymakers are rattled isn’t that Mythos will suddenly own your bank account tomorrow — Anthropic is keeping the model caged, and non-state actors can’t train their own. The fear is the gap period: a stretch of months where a Mythos-class capability exists, hasn’t been fully used for defense yet, and could be replicated by a nation-state adversary with the means and the motive. China can probably build one. Iran and Russia probably can’t — yet. Whichever side gets through the world’s legacy open-source libraries first owns the window.
The underappreciated story is that this round of the offense-defense arms race may actually tip toward the defense. Mythos didn’t find bugs an elite human researcher couldn’t have caught; it just did it at machine speed and machine scale. Applied to new code, that points at a future where shipped software arrives without the kind of rotten foundations that made Equifax, NotPetya, and every critical-infrastructure nightmare possible. The catch is that the patching has to get done before the capability gets out. Glasswing is supposed to run through the summer. That’s the runway.
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit globaltantrum.substack.com