With AI, cyberattacks come fast; it’ time firms patch faster

Timely wake-up call to review security processes, automation of patch testing

- Irene Tham Technology Editor

News on April 7 that Anthropic withheld the public launch of its latest artificial intelligence (AI) model, sharing it with only a tightly controlled group, has triggered a harsh reality check.

The San Francisco-based research firm said its latest Claude Mythos Preview is shared with only about 50 tech firms, including Microsoft, Google, Amazon and Apple (via an initiative dubbed Project Glasswing), as the tool could attack existing software without human action.

In a grave note on its website, Anthropic said: “Given the rate of Al progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely. The fallout — for economies, public safety and national security - could be severe.”

It is no secret that Al models have been assisting hackers in finding software flaws for some years now, quickening the discovery of zero-day vulnerabilities from months to hours. Zero-day vulnerabilities are flaws unknown to the software maker, and thus, they have no fix.

But it was not until Claude Mythos Preview that AI models could also act autonomously – that is, they can find new vulnerabilities and generate code to exploit the flaws. With this tool, the barrier to connecting multiple minor vulnerabilities into a full system compromise has been substantially lowered.

That AI models can act without human intervention is an emerging reality that has happened sooner than most expected and is causing widespread alarm.

Following the April 7 news break, US Treasury Secretary Scott Bessent and Federal Reserve chairman Jerome Powell called a surprise meeting with Wall Street leaders over concerns that Claude Mythos Preview would usher in an era of greater cyber risk.

South Korea’s Ministry of Science and ICT reportedly held an emergency briefing with major domestic cybersecurity companies to discuss countermeasures.