The AI That Can Hack: Why Anthropic Is Holding Back Its Most Powerful Model

A New Kind of AI Has Arrived — And It's Being Released With the Brakes On

Last week, Anthropic announced something quietly extraordinary: a new AI model called Mythos that's supposedly so good at finding security vulnerabilities in software that the company decided not to release it to the public in full. Instead, only a limited version is available, and only to certain users.

This isn't the typical AI product launch. There's no flashy demo, no promise that it'll revolutionize your workday. Instead, Anthropic is essentially saying: "We built something powerful, and we're scared of what might happen if everyone gets their hands on it."

For those of us without computer science degrees, here's what's happening and why it matters.

What Mythos Actually Does

Think of Mythos as an AI that can read software code the way a master locksmith reads a lock — not just understanding how it works, but spotting the weaknesses. Security vulnerabilities are like tiny flaws in a building's foundation. Hackers look for these flaws to break into systems, steal data, or cause damage. Until now, finding these vulnerabilities required serious expertise and time.

Mythos can apparently do this work faster and more thoroughly than most human security experts. That's the breakthrough — and the problem. Because if Mythos can help good actors find and fix vulnerabilities, it can just as easily help bad actors exploit them.

Imagine a retired accountant who runs a small online bookkeeping business. Her website probably has security flaws she doesn't know about — most small business websites do. In a world where tools like Mythos are widely available, a would-be hacker doesn't need to be a technical genius anymore. They could simply ask an AI to scan her site and tell them exactly where the weak spots are.

Why This Feels Different

We've heard warnings about AI risks before, but they often feel abstract — hypothetical scenarios about superintelligent machines decades in the future. Mythos is different. It's here now, and the risks are immediate and concrete.

Anthropics's decision to limit access isn't about protecting some distant future. It's about protecting the internet as it exists today. The software running hospitals, banks, power grids, and yes, small businesses — much of it has vulnerabilities. Security experts have long operated under an informal agreement: when they find a flaw, they report it privately to the company so it can be fixed before hackers find it. This is called "responsible disclosure."

But what happens when an AI can find thousands of these flaws faster than humans can fix them? What happens when that AI isn't limited to security researchers with ethics training, but is available to anyone with an internet connection and bad intentions?

The Uncomfortable Questions

Anthropics's caution raises questions the AI industry has mostly avoided. Up until now, the prevailing attitude has been: build it, release it, see what happens. That's how we got ChatGPT, which OpenAI released to the public and then scrambled to patch as people discovered it could be manipulated into giving dangerous advice or generating harmful content.

Mythos suggests that era might be ending. When an AI's capabilities cross certain thresholds — when it can genuinely cause widespread harm if misused — maybe the old "move fast and break things" approach doesn't work anymore.

Some security experts are skeptical. They argue that limiting access to Mythos is either ineffective (because hackers will eventually get it anyway) or self-serving (because Anthropic gets to look responsible while its competitors face pressure to follow suit). Others say it's a necessary first step toward treating powerful AI models more like controlled substances than consumer products.

What This Means for the Rest of Us

For everyday people, this development is a preview of a broader shift. We're entering a period where AI companies will increasingly face a choice: release powerful tools that could be misused, or hold them back and accept the criticism that they're gatekeeping.

There's no perfect answer. But the fact that Anthropic chose caution over hype is worth noting. It suggests that at least some AI companies are beginning to recognize that not every capability should be democratized immediately, and that being first to market isn't always more important than being responsible.

For a small business owner or retiree, the practical takeaway is simpler: the internet is about to get more dangerous before it gets safer. Tools like Mythos mean that finding security vulnerabilities is becoming easier, which means the bad guys have new weapons. The flip side is that the good guys do too — if companies use tools like Mythos to find and fix their own vulnerabilities faster.

The race is on. And for once, an AI company decided not to hand everyone the starting gun at the same time.