The Guardian view on Anthropic's Claude Mythos: when AI finds every flaw, who controls the internet? | Editorial

Anthropic’s Claude Mythos is described as autonomously finding and exploiting previously unknown zero-day flaws, raising concerns that AI will make cyberattacks much faster and easier. The company has shared the model only with Britain outside the US, and governments are increasingly treating frontier AI as a cybersecurity and strategic infrastructure issue. The article argues this could push firms and states toward fragmented security alliances rather than a single global internet.

Analysis

The market is underpricing a shift from “AI as productivity tool” to “AI as exploit automation.” That matters because the first-order benefit accrues to model vendors and select security firms, but the second-order effect is a spending cascade: every enterprise, cloud provider, browser vendor, and endpoint stack will be forced to buy more detection, sandboxing, identity hardening, and red-team services over the next 2-6 quarters. The winners are not just the obvious cybersecurity names; it is also the infrastructure layer that can embed trust, verification, and access control into workflows that were previously assumed safe by default.

The more important risk is not a single catastrophic breach, but the compression of attacker skill into cheap, scalable capability. That changes the economics of cyber insurance and incident response first, then eventually the cost of capital for software-heavy companies with weak security posture. Expect a bifurcation: vendors with secure-by-design architectures, strong telemetry, and identity-centric products should gain share, while legacy perimeter vendors and crowded application-layer tools face pricing pressure as buyers reallocate budget toward prevention and response automation.

The contrarian takeaway is that this may be less of a moat for frontier-model incumbents than the market assumes. If smaller models can deliver similar offensive capability, then the monetization is likely to diffuse quickly into open-source and adversarial channels, making governance the bottleneck rather than model access. That raises the probability of regulatory intervention and public-sector procurement, which tends to favor established security software platforms and government-aligned contractors over pure-play frontier labs. The biggest near-term catalyst is a visible enterprise breach attributable to AI-assisted exploit generation; that would accelerate budget cycles immediately, while a lack of headline incidents could leave the theme temporarily overbought.

Key Decisions for Investors

• Overweight PANW and CRWD into the next 1-3 quarters; both should benefit from accelerated CISO spending on identity, endpoint, and detection after any high-profile AI-enabled breach. Use pullbacks to build, targeting a 15-20% rerating if cyber budgets reaccelerate.
• Initiate a long FTNT / short a basket of legacy perimeter-security peers as a relative-value pair over 6-12 months. Thesis: buyers shift from box refreshes to telemetry-rich, AI-native security stacks; risk is pricing pressure if enterprise budgets stay flat.
• Buy call spreads on CRWD or ZS out 6-9 months to express upside convexity to an inflection in cyber urgency. Favor structures with defined downside because the catalyst is event-driven and timing is uncertain.
• Short or underweight cyber insurers and weaker software exposure with poor security reputation over 3-6 months if breach frequency rises. The risk/reward skews negative as claims inflation and customer churn can hit before regulation catches up.
• Watch for public-sector procurement beneficiaries such as MSFT and PLTR if governments formalize AI-security standards; these names can capture compliance-driven spend with lower customer acquisition friction than niche vendors.