Anthropic's Claude Mythos Raises the Threat: AI Puts Cyberattacks Within Reach of Novices

In April 2026, Anthropic unveiled Claude Mythos Preview and sharply escalated the debate over how AI is changing cybersecurity. The industry's biggest fear is no longer that models find bugs, but that people without deep technical training can now find and exploit them.

From Competition to Alarm

Back in August 2025, at the DARPA AI Cyber Challenge in Las Vegas, teams tested automated vulnerability-discovery systems on 54 million lines of real code. The tools found not only deliberately planted flaws but also genuine bugs that the organizers had not planned to showcase. It was an important shift: even before the buzz around Mythos, it was clear that AI could already find vulnerabilities at a scale that takes a human, or even a regular team of researchers, far longer.

Now the market fears not automation itself but its democratization. Script kiddies used to grab ready-made scripts from the internet and run other people's exploits, often without understanding how they worked. With AI models at this level, the scheme changes: instead of copying old tools, an attacker can ask the system in a conversation to study new code, propose an attack chain and refine an exploit for a specific target. For low-skilled attackers, this is no longer just a speedup but almost a new class of capability.

Attacks Have Become Cheaper

What worries experts most is not Claude Mythos itself but the sharp drop in the cost of an attack in the broad sense: time, effort and required skill. Researchers say that finding a serious vulnerability in an unfamiliar codebase could once take weeks or months, and now takes hours. Tim Becker of Theori, one of the AIxCC finalists, says outright that with minimal prompting, and sometimes none at all, AI can already find zero-days in widely used software.

"The barrier to entry for finding a bug in a million-line codebase is

now much lower than before."

As a result, it becomes worthwhile to attack even systems that once seemed too niche or too expensive to research. If the effort is almost free, malicious actors can look for weaknesses in rare configurations, internal corporate software or services used by a single company. The models can quickly iterate through options, combine known error patterns and write working exploit drafts almost on the fly.

Anthropic is trying to contain the risk: access to Mythos is restricted, and Claude Opus 4.7 has added protection against malicious cyber requests. But nobody guarantees that other developers will be equally cautious.

The Main Problem Is Patches

For companies, the main risk now looks less like a "vulnerability apocalypse" and more like a "patch apocalypse." If models find thousands of problems faster than teams can verify and fix them, the bottleneck is no longer discovery but response.

Experts advise preparing a Mythos-ready plan now: segment networks, clean up identity and access management, move to memory-safe approaches where possible, and drop reliance on weak authentication. The fewer layers of defense a company has today, the more the next wave of vulnerability reports will hurt.

• Network and service segmentation
• Strict control of identities and access
• Safer code and architecture
• Phishing-resistant authentication and fast updates

There is another unpleasant effect: the window between a vulnerability's disclosure and the appearance of an exploit is almost closing. As soon as a patch ships, attackers can pick it apart, work out what exactly was fixed and hunt for systems that have not been updated. Prioritization therefore becomes almost as hard as the fix itself. A critical vulnerability in an internal service is not always more dangerous than a less severe flaw on the external perimeter.

People must handle this flow: threat analysts, incident responders and engineers who know the codebase deeply enough to fix things not only quickly but also without creating new problems down the line.

Theori's Xint tool is a telling example. According to the company, it found all the bugs Mythos discovered in the same codebases and added 12 more zero-days that were not in Anthropic's original announcement. But fixing what is found is far harder than finding it. A good patch requires context: you must understand whether it will break functionality, hurt code maintainability or create new holes. For open source this is especially hard, because small teams and individual maintainers may be buried under a stream of tickets they cannot handle at the speed at which AI generates findings.

What It Means

AI is changing offensive security faster than companies are rebuilding their defensive processes. In 2026, the winners will not be those with the most scanners, but those who can quickly prioritize risks, ship updates and build more secure software in advance. Otherwise, even attackers without serious training will get tools that were once available only to strong researchers and advanced groups.