Anthropic Withholds AI Tool Over Cybersecurity Fears

Anthropic has confirmed it will not release its latest AI model, Claude Mythos, to the public, citing its unprecedented ability to identify and exploit software vulnerabilities at scale. The San Francisco-based AI startup revealed the model uncovered thousands of previously undetected flaws in widely used applications, including a 27-year-old vulnerability in a video software system tested over 5 million times by its developers, according to The Guardian.

Mike Krieger, a spokesperson for Anthropic Labs, stated at the HumanX AI conference that the company is explicitly withholding Mythos from public distribution. Instead, Anthropic is collaborating with cybersecurity specialists and open-source engineers through a project dubbed "Glasswing," which includes partnerships with Amazon, Apple, Microsoft, CrowdStrike, Palo Alto Networks, Cisco, and the Linux Foundation. The initiative aims to "arm defenders ahead of time" by leveraging Mythos to identify and patch vulnerabilities before malicious actors exploit them.

Anthropic’s blog post warning of Mythos’s capabilities emphasized that AI models have reached a threshold where they can "surpass all but the most skilled humans at finding and exploiting software vulnerabilities," with potential consequences for "economies, public safety, and national security." The model’s ability to detect subtle flaws—such as a dormant bug in a system that had eluded its creators for decades—has prompted urgent industry collaboration.

Anthony Grieco, Cisco’s chief security and trust officer, described the situation as requiring "a fundamental change in urgency" to protect critical infrastructure. Crowdstrike’s CTO, Elia Zaitsev, noted that the "window between a vulnerability being discovered and exploited by an adversary has collapsed—what once took months now happens in minutes with AI." Project Glasswing participants are sharing Mythos findings while Anthropic allocates $100 million in computing resources to accelerate vulnerability remediation.

The company’s decision follows a recent leak of Mythos code, which prompted Anthropic to publicly address the risks. While Anthropic claims it is "raising awareness" of AI-driven cybersecurity threats, critics caution that the startup’s narrative may align with its commercial interests. The BBC highlighted that distinguishing "justified claims from hype" remains challenging in the AI sector, though Anthropic’s focus on defensive applications has drawn support from major tech firms.

Government agencies are also taking notice. Canadian Finance Minister François-Philippe Champagne described Mythos as an "unknown unknown" requiring "serious attention" at an IMF meeting, while Bank of England Governor Andrew Bailey acknowledged the need to reassess cybercrime risks. The EU has joined discussions with Anthropic, and the company has engaged with U.S. officials despite a February White House directive to terminate federal contracts—a move currently under legal review.

Anthropic’s approach reflects a broader industry shift toward "AI safety by design," though its selective sharing of Mythos has sparked debate. As Logan Graham, a lead Anthropic security researcher, stated, the model represents "the starting point for what we think will be an industry change point." For now, the tech world awaits whether Glasswing’s collaborative model can outpace the escalating threat of AI-powered cyberattacks—or whether the very tools designed to defend infrastructure will become the next frontier for exploitation.

Artūras Malašauskas is an AI Systems Integrator with 20+ years of production-grade web engineering experience. He has designed, shipped, and scaled enterprise Python/PHP systems for logistics, SaaS, and public-sector clients. For the past year, he has focused exclusively on AI integrations: deploying open-source LLMs, building generative media pipelines (image, audio, video), and engineering multi-agent workflows for real production environments. His standard: reproducibility, security, cost-efficient inference—no vaporware. He documents and evaluates emerging AI tooling, separating verified capabilities from marketing noise. Technical editor at: muza-ai.eu, ai-verslas.lt, ai-naujinos.lt Connect on LinkedIn