Governments, financial institutions, companies, and citizens have all raised concerns over the ability of Anthropic’s Mythos — and its younger sibling, Fable— to identify vulnerabilities, chain them, and write code to exploit them. Some of this is the result of an intentional public relations campaign intended to support regulatory capture. But it does not adequately reflect the reality of cybersecurity.
There are thousands of vulnerabilities in the deployed software environment. What Mythos does is lower the cost of finding those vulnerabilities and exploiting them. The major signals intelligence nations have likely had similar capabilities for years.
Mythos follows the conventional economic script of substituting machines for labor. The US’s major cyber opponents have thousands, if not tens of thousands, of hackers looking to find and exploit American vulnerabilities every day. With tools like Mythos, they can now be more aggressive, more active, and cover more terrain — but frankly, the level of opponent success was already so high that Mythos may not make things much worse.
Think of the cyber environment as shaped by three classes of actors:
- Leading cyber powers: Russia, China, the US, the UK, Israel, and a few others. These countries have had Mythos-like capabilities, albeit more expensive and perhaps less universal, for some time.
- Advanced cyber criminals, mainly Russian-speaking, have made ransomware a tangible cost. These groups can probably duplicate some of the capabilities of the most sophisticated cyber powers. They will benefit from Mythos or similar AI tools in terms of cost and scale of action, but they are already more than adequate when it comes to capability.
- Everyone else. These are the countries that lack the dedicated units and the resources necessary to exploit cyber vulnerabilities. It also includes criminal groups that lack the resources, if not the intent, to engage in malicious cyber activity. This third group will be the major beneficiary of Mythos-like tools.
The first two categories of sophisticated opponents are already successful, if not always visibly so. Their success rate is so high that Mythos simply lowers its cost. This will free up resources for even more activity, but given their maximal success rate, additional losses are likely to be marginal.
The immediate effect is likely to be a surge in cybercrime simply because more criminals can find vulnerabilities, design successful exploits, and apply them faster than defenders can patch or repair. While damaging and expensive, the increased level of crime is unlikely to become an existential threat.
Advanced cyber criminals’ behavior has always been determined by opportunity cost. They have resource constraints and prefer to go after targets that are easier to hack while promising the greatest return — healthcare has been a favorite target. By lowering the opportunity cost of cybercrime, Mythos enables a larger set of targets to be attacked. If Mythos increases revenue from cybercrime, people will invest more in it, creating at least temporarily both an increase in incidents and a shortage of cybercrime talent.
The most troubling of these new targets are in the financial sector. Banks and other financial actors have done better than most at securing their networks. This could change, at least temporarily, as previously unknown vulnerabilities are discovered in financial networks and exploited by advanced cyber criminals.
At the other end of the attack scale, China (and some say Russia) has already hacked tens of millions of household devices, providing it with immense access to American networks. It has hacked leading research facilities and critical infrastructure. It is not clear how much worse Mythos-like capabilities will make things.
In the event of an armed conflict, Mythos-like tools will enable more agile, rapid, and extensive attacks, but again, this underestimates opponents’ current capabilities. In the absence of armed conflict, the same implicit political ceiling that currently inhibits the use of cyber-attacks by major powers — opponents wish to avoid actions that could escalate into a larger and more damaging conflict — will continue to apply. Mythos does not change this.
One dilemma for state attackers is when to exploit the vulnerabilities Mythos may discover. The most likely scenario is that Mythos or Mythos-like tools will identify vulnerabilities, and state opponents will first attempt to implant undiscoverable malicious code for future use. This means we may not immediately appreciate the full risk of Mythos.
This means that an adequate defense will require something other than cyber tools. We are not going to be able to patch or secure networks given the already existing level of vulnerability. The best defense is to change opponents’ perception of the risk of undertaking cyber action to dissuade them from fully exploiting Mythos. This will require disrupting criminal and state networks, implementing aggressive policing and punishment, and taking punitive actions below the level of the use of force to change opponents’ risk calculus. In other words, the things we should have been doing for the last decade.
Mythos does not create existential risk. No AI product does. It is sloppy thinking to equate AI with nuclear weapons. On the other hand, the positive effect of Mythos may be that the level of disruption will be intolerable, if not existential, forcing people to take cybersecurity seriously and take the measures needed to make software less vulnerable and networks more secure.
James Lewis is a Distinguished Fellow at CEPA’s Tech Policy program.
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
Tech 2030
A Roadmap for Europe-US Tech Cooperation
