Anthropic Opens Claude Mythos to More Cybersecurity Teams: What 129,000 Verified Software Flaws and New Access Tiers Mean for Defenders, Red Teams and Critical Infrastructure | The Daily AI Chat

SPEAKER_1 (0:09)

Welcome to The Daily AI Chat. This podcast is curated by our human friend, Fred, and we are your dedicated AI hosts.

SPEAKER_2 (0:17)

Glad to be here for this one.

SPEAKER_1 (0:18)

Yeah. So I want you to imagine just for a second, the sheer amount of invisible software you've interacted with since you woke up this morning.

SPEAKER_2 (0:28)

Oh, it's everywhere.

SPEAKER_1 (0:29)

Right. Like you checked your phone, maybe paid for coffee with a tap, you drove through a traffic light network, sat in a building powered by a regional grid.

SPEAKER_2 (0:39)

All running on millions of lines of code.

SPEAKER_1 (0:41)

Exactly. Millions of lines of code, holding your whole day together.

Now, what if someone told you that the invisible locks on all those digital doors are currently being rattletested, all at once?

SPEAKER_2 (0:54)

Rattletested by an AI.

SPEAKER_1 (0:56)

Right.

An artificial intelligence operating at superhuman speed. Because today is October 6, 2026, and a massive new Reuters report, just published today by reporters Anwar Mehraj and Jeffrey Dastin, reveals that, well, this isn't a hypothetical scenario.

SPEAKER_2 (1:15)

No, it's happening right now.

SPEAKER_1 (1:16)

It really is. The report says, Anthropic is dramatically expanding something called its Cyber Verification Program, or the CVP.

SPEAKER_2 (1:24)

Which is a huge deal.

SPEAKER_1 (1:26)

It is. They are taking their most highly capable Claude AI models, intentionally stripping away some of the usual safety guardrails, and handing them over to vetted cybersecurity professionals to do authorized defensive work.

SPEAKER_2 (1:41)

The scale of this shift really cannot be overstated. We are moving from AI as a general purpose assistant, to AI as a highly specialized, unconstrained weapon for defensive cybersecurity.

SPEAKER_1 (1:53)

Yeah, weapon is the right word.

SPEAKER_2 (1:54)

It is. And to really understand the magnitude of this Reuters report, we need to decode the massive scale of AI-assisted vulnerability hunting that forced Anthropic to make this move in the first place.

SPEAKER_1 (2:05)

We also need to unpack the highly specific three-tiered access system they just introduced, because they have to control who gets these models.

SPEAKER_2 (2:12)

Exactly. And most importantly, we have to explore the intense dual-use tension here.

SPEAKER_1 (2:17)

Right, the dual-use problem.

SPEAKER_2 (2:18)

Because you are handing out software that is incredibly powerful for defending systems. But if access isn't managed perfectly, those exact same capabilities become, well, a roadmap for attackers.

SPEAKER_1 (2:30)

Yeah. I actually want to visualize what Anthropic is doing by removing these guardrails.

SPEAKER_2 (2:34)

Go for it.

SPEAKER_1 (2:35)

Okay. So imagine you are the lead security engineer for a newly built 100-story skyscraper.

SPEAKER_2 (2:42)

Okay.

SPEAKER_1 (2:42)

It has thousands of doors, thousands of different locks. And you need to test every single one to make sure an intruder can't get in.

SPEAKER_2 (2:50)

That sounds like a nightmare.

SPEAKER_1 (2:51)

Right.

You could hire a massive team to walk the halls and jiggle every handle manually. Or you could forge a master key that slides into every lock, instantly testing the Templars.

SPEAKER_2 (3:03)

Instantly.

SPEAKER_1 (3:04)

Anthropic is essentially handing out the master key.

It allows you to secure the building at a speed that would otherwise be impossible. But you have to be agonizingly careful about whose pocket that master key ends up in. Yeah.

SPEAKER_2 (3:16)

That analogy really captures the utility. But I think we should push it a step further to understand the real risk here.

SPEAKER_1 (3:22)

How so?

SPEAKER_2 (3:23)

Well, it isn't just a master key. It's more like it's a blueprint generator.

SPEAKER_1 (3:27)

Oh, wow.

SPEAKER_2 (3:27)

Yeah. When you give an advanced model like Claude Mythos an unconstrained look at your system, it doesn't just tell you a lock is broken.

SPEAKER_1 (3:33)

Right. It does more than that.

SPEAKER_2 (3:34)

It can explain exactly how to exploit that broken lock. It tells you how to bypass the alarm, how to access the vault.

That is the dual-use reality.

SPEAKER_1 (3:44)

Which is terrifying if it gets into the wrong hands.

SPEAKER_2 (3:46)

Exactly. The sheer volume of broken locks they're running is exactly why they are overhauling this program.

SPEAKER_1 (3:52)

So let's get straight into those numbers then. Because the data from the Reuters report is honestly a little dizzying.

SPEAKER_2 (3:59)

It really is.

SPEAKER_1 (4:00)

So between April and July of 2026, Anthropic ran an initiative called Project Glasswing.

SPEAKER_2 (4:06)

Right. Project Glasswing.

SPEAKER_1 (4:08)

They gave a select group of critical software protectors early access to Claude Mythos. And in just those four months, these partners reported 129,000 verified vulnerabilities.

SPEAKER_2 (4:20)

Yeah. Let that sink in.

SPEAKER_1 (4:21)

129,000. It's unbelievable.

And then Anthropic did their own entirely separate open-source scanning between April and October, finding another 5,500 vulnerabilities.