When Anthropic first disclosed Mythos in April, it sent an anxious shockwave through much of the cybersecurity sector. The new AI model was allegedly so ruthlessly effective at finding and exploiting security vulnerabilities in existing software that the company said it was holding off on a public release and would only grant access to a small group of early testers, including the U.S. National Security Agency (NSA).
Another wave of fear reverberated this week after the NSA reportedly discovered multiple vulnerabilities within its own cybersecurity systems during its tests with Mythos. If that agency—which supposedly boasts the most impenetrable cyberdefenses in the world—can be hacked by Mythos, what hope does the rest of the world’s cybersecurity infrastructure have?
This latest round of panic began with what seems to have been something of a game of telephone: Someone says one thing, which gets repeated by another, and another after that, and along that chain of communication, the original statement is distorted. Last week, The Economist reported that during a June 11 hearing before the Senate Committee on Banking, Housing, and Urban Affairs, Democratic Senator Mark Warner of Virginia said that Mythos had broken into “almost all of [the NSA’s] classified systems, not in weeks, but in hours.” Warner said he’d received that information from the head of the NSA himself, General Joshua Rudd, who also leads the Pentagon’s Cyber Command division. On Monday, a coalition of intelligence agencies—including the NSA and its counterparts in Canada, the U.K., Australia, and New Zealand— issued an unusually public warning that the risk that AI now poses for cybersecurity warrants a “whole-of-society response.”
The Economist’s report was seen by some as evidence that the worst fears about Mythos were true, a reaction that was undoubtedly fueled also by the aura of power and mystery that has coalesced around the model in recent months. That aura has arguably been a boon for Anthropic, which recently usurped OpenAI as the most valuable startup in the world and is preparing for what’s expected to be a historic IPO.
But it’s also been a contributing factor in its latest skirmish with the Trump administration, which ordered the company earlier this month to restrict access for all foreign nationals to Fable 5, a “Mythos-class” model that had recently been made publicly available and which was built with safeguards that to some users were annoyingly stringent. Citing national security concerns, the administration invoked an obscure piece of export control legislation, a move that, according to some legal experts, is spurious. Many cybersecurity experts, meanwhile, argued that the ban would hamstring U.S. cybersecurity defenses and give adversaries like China the upper hand.
That argument was seemingly vindicated by a Tuesday report from the New York Times which said that Trump’s ban—which also targeted another model called Mythos 5, which had only been made available to a small group of organizations—had put the kibosh on the NSA’s internal tests with Mythos, and that the administration was now working with Anthropic to reinstate the agency’s access for limited purposes related to national security. The NSA did not immediately respond to Gizmodo’s request for comment.
That same report from the Times also clarified that the NSA’s internal tests with Mythos were less apocalyptic than online rumors might suggest. According to federal officials cited in the report, the tests were carried out in a digital environment so robustly controlled that it’s very unlikely any hacker or foreign intelligence agency could replicate them. The officials also told the Times that even though Mythos was able to identify cybersecurity vulnerabilities, it didn’t actually exploit them.
The author of the report in The Economist—the one that had been the initial cause of all the worry—has also admitted that his portrayal of the NSA’s tests with Mythos had been misleading. The tests “surely [involved] using Mythos alongside other tools under very particular conditions,” he wrote in a X post on Sunday. “I quoted [Senator Warner] to give a sense of Mythos’ potency. But it was a mistake not to have added caveats.”
Read the full article here
