AI is finding security holes faster. What to do

On 7 April, Anthropic announced a model it has decided not to release to the public. Claude Mythos Preview is a general-purpose model that turned out to be unusually good at finding and exploiting security flaws in software. Anthropic says it found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. One had been sitting in OpenBSD, an operating system known for its focus on security, for 27 years. Another, in the widely used video library FFmpeg, was in a line of code that automated testing tools had run five million times without catching the problem.

Instead of releasing it publicly, Anthropic is giving access to a group of organisations that maintain critical software, under the name Project Glasswing. The launch partners include AWS, Apple, Google, Microsoft, Cisco, CrowdStrike, Palo Alto Networks, JPMorganChase and the Linux Foundation, with more than 40 others, and Anthropic is covering up to $100 million of usage. The idea is to let defenders find and fix the worst flaws before tools like this are widely available.

You are unlikely to use Mythos itself any time soon, and you do not need to. But it changes the security picture for every business that runs software.

Why this matters even if you are small

For most of computing history, finding a serious flaw took skilled people a lot of time. That scarcity protected everyone a little. Plenty of bugs sat undiscovered for years simply because nobody looked hard enough.

Models like this remove much of that scarcity. Today they are in defenders' hands. Similar abilities will spread over time, including to people who mean harm, and Anthropic says as much. The likely result is that the time between a vulnerability becoming known and attackers using it keeps shrinking.

Small businesses are rarely the target of clever attacks. They are the target of automated ones: bots that scan the internet for any site running an old plugin with a known hole. When finding and exploiting holes gets cheaper, those bots get more to work with, and they get to it faster.

The unglamorous steps that protect you

You do not need new security products. You need to do the basics on time.

1. Update promptly. Websites, plugins, phones, laptops, routers. Turn on automatic updates wherever you can. The gap between "patch released" and "patch needed" is closing.
2. Remove what you do not use. Every old plugin, test site, forgotten subdomain and unused app integration is something to keep patched. Deleting it is cheaper.
3. Turn on multi-factor authentication for email, your domain registrar, hosting, payment accounts and social media. Email first, because it resets everything else.
4. Keep backups you have tested, stored separately from the systems they protect.
5. Know who looks after your software. If your website or app was built by someone who has since moved on, find out who now updates it, how often, and how quickly they respond when an urgent fix comes out.
6. Ask your developers about dependencies. Modern software is built from hundreds of open-source packages. Someone should be updating them regularly and scanning for known issues, with tools that do this automatically.

If you build software

If your business ships its own app or platform, a few more steps are worth taking now:

• Run automated dependency and code scanning on every change, not once a year.
• Use the AI tools you already have to review your own code for security issues. They are not Mythos, but they catch a great deal, and defenders using them is the point.
• Review AI-written code with security in mind, especially anything handling logins, permissions, payments or file uploads.
• Have a written plan for an urgent patch: who gets told, who fixes, how fast it ships, and how customers are informed if needed.

Keep it in proportion

There is no reason to panic. Anthropic's decision to give defenders a head start is a good sign, and the examples it has published have already been patched. Most of the damage done to small businesses still comes from reused passwords, phishing emails and software nobody updated.

The change is one of speed. Habits that were good practice, such as patching within a week or reviewing plugins every quarter, are becoming the minimum. A business that keeps its software current, its accounts locked down and its backups tested is in a strong position however clever the attackers' tools become.