Anthropic develops AI ‘too dangerous to release to public’

Anthropic has restricted access to its Claude Mythos Preview after the model uncovered 'thousands' of security vulnerabilities — including a 27‑year‑old OpenBSD bug — and demonstrated the ability to generate working remote‑code‑execution exploits and evade internal controls. Access is being limited to top tech firms (Amazon, Apple, Microsoft) under 'Project Glasswing' so they can find and fix flaws, while Anthropic is in ongoing talks with the US government after being designated a 'supply chain risk' and winning a temporary injunction. This raises material cybersecurity and regulatory risk for major tech platforms and critical infrastructure and could accelerate defensive spending and oversight of powerful AI systems.

Analysis

The immediate market reaction should favor large cloud incumbents and enterprise security vendors because they will capture both demand to remediate newly discovered vulnerabilities and the professional services work to harden stacks — think sustained incremental security budgets rather than one-off consulting projects. Expect enterprises to reallocate an estimated 5–15% of incremental AI/automation IT spend into defensive tooling, detection, and third-party verification over the next 12–24 months; that structural shift benefits recurring-revenue security names more than capex-heavy incumbents.

A key second-order effect is widening moat consolidation: privileged access to high-capability models becomes a de-facto barrier to entry. Firms that can run such tools internally (large hyperscalers, defense primes, or well-capitalized security vendors) will underprice the latent risk in their services and win long-term contracts, while smaller AI startups face higher compliance and audit costs that compress gross margins and raise customer acquisition costs.

Tail risks center on operationalization and regulation. A single real-world exploit attributable to an AI-discovered chain of vulnerabilities could trigger immediate policy action (export controls, model vetting requirements) and a sub-90-day market shock to AI growth narratives; conversely, if defensive automation matures quickly and is commoditized, the market could re-rate security vendors downward in 12–36 months. Watch regulatory milestones (CISA/EU digital resilience rules) and any publicly weaponized exploit as 0–90 day catalysts that will re-price winners and losers sharply.

Key Decisions for Investors

• Initiate a 6–12 month overweight in enterprise detection & response: buy CRWD (CrowdStrike) or PANW (Palo Alto) shares for a 2–3% portfolio weight. Rationale: recurring revenue capture from remediation + professional services. Risk/reward: expect 25–45% upside if budgets reallocate as forecasted; downside 15–25% on multiple compression or commoditization—reduce position if large OSS defensive tooling emerges.
• Take modest asymmetric exposure to hyperscalers that gain privileged defensive access: buy MSFT 9–12 month OTM call options sized to 0.5–1% of book (or equivalent LEAP exposure). Rationale: direct benefit to cloud security offerings and enterprise lock-in. Hedge: fund calls by selling near-term covered calls or buy a 3–6 month put (cost cap). Target: 30–60% option return if enterprise contract cadence accelerates; loss limited to premium.
• Pair trade to express structural winners vs speculative AI infra: go long CRWD/PANW (equal-weight) and short a basket (~3–5 names) of sub-$1B revenue pure-play AI infrastructure vendors with negative free cash flow. Timeframe 6–18 months. Risk management: stop-loss at 12% adverse move; target gross pair payoff 25–40% as security multiples rerate upward.
• Small tactical 12–24 month buy in defense/insurance-adjacent names: add a 1% position in large defense primes (e.g., LMT/RTX) or insurers with cyber lines as a hedge against geopolitical spillovers and rising cyber premiums. Rationale: diversification into cash-flow stable beneficiaries of increased government/enterprise cybersecurity spend; expected low-single-digit alpha with downside protection during risk-off events.