What do cyber-capable AI models mean for your own security?

On April 7, Anthropic said its unreleased model Claude Mythos Preview can find serious, previously unknown flaws in all the major operating systems and browsers, and write working attacks for many of them, often without human help. Instead of releasing it, the company gave restricted access to a group of large technology firms and open-source maintainers under an effort called Project Glasswing, so defenders can fix the most important software first. Anthropic says it did not train the model for this specifically; the skill grew out of general improvements in coding and reasoning.

You will not be using Mythos Preview, and neither will most attackers for now. But the announcement is a clear signal about where AI is heading, and it changes the arithmetic of everyday security in one specific way.

The change that matters for you: the patch gap

Two terms help. A zero-day is a flaw nobody has fixed yet because the software maker doesn't know about it. An N-day is a flaw that has already been fixed and announced, but still works against every device that hasn't installed the fix.

Most real harm, Anthropic notes, comes from N-days. When a company releases an update, the fix itself points to where the weakness was. Turning that into an attack used to take a skilled researcher days or weeks. Anthropic reports that its model can now do it on its own, starting from little more than the public notice of the flaw, much faster and more cheaply.

So the dangerous period is the gap between "update available" and "update installed." Anthropic's advice to software users and administrators is direct: shorten the time it takes to install security updates, turn on automatic updates wherever possible, and treat updates that carry security fixes as urgent rather than routine.

The longer view is more hopeful. Anthropic expects tools like this to favor defenders eventually, as software makers use them to find and fix bugs before release, much as automated testing tools did before. It also warns that the transition could be rough. Your job during that transition is mostly to avoid being the slowest to update.

A worked checklist for a home or small business

Here is a one-hour review you can do this week. The examples in the right-hand column are illustrative.

The order matters. Updates and unsupported devices come first because they address the gap described above. Accounts and backups come next because they limit the damage if something still goes wrong.

Which basic protections matter more now?

Speed of updating moves to the top. If attackers can turn a published fix into an attack within hours rather than weeks, a device that updates automatically overnight is far safer than one that waits for someone to remember. Turn automatic updates on everywhere it is offered, and restart when prompted. For a small business, set a rule that security updates are installed within days, not at the next quarterly maintenance.

Unsupported devices become a bigger liability. A device that no longer receives fixes will collect known, published weaknesses with no way to close them. An old router, a phone past its update period, or an aging network drive are the first things to replace or disconnect.

Ask your suppliers about their update process. Much of a small organization's software is run by others: a website host, a booking system, a payment terminal. Anthropic's advice to software makers is to ship fixes faster and make them painless to apply. As a customer, it is reasonable to ask how quickly they patch and whether updates are automatic.

The other basics still carry their weight. A stolen password or a convincing fake message is still an easy way in. Unique passwords in a password manager, two-step sign-in on your email, and a backup kept apart from your main computer protect you whatever tools attackers use. None of these steps is new; what has changed is how much it costs to be slow.