Anthropic Teams Up With Its Rivals to Keep AI From Hacking Everything

Anthropic launched Claude Mythos Preview and convened Project Glasswing, granting private access to the model to Microsoft, Apple, Google, AWS, Nvidia, Broadcom, Cisco, the Linux Foundation and 40+ other organizations. Use of the preview has already uncovered "thousands" of critical vulnerabilities, and Anthropic is pursuing a staggered release to give platform owners time to test and patch; the company warns similar capabilities could be broadly available in 6–24 months. This is a sector-level development that could materially alter software security practices and requires accelerated vulnerability management and coordinated disclosure by infrastructure and security teams.

Analysis

This initiative crystallizes a near-term bifurcation: hyperscalers and chipset/cloud infrastructure vendors will pick up incremental, defensible revenue from accelerated security programs over the next 6–24 months, while smaller niche vendors and legacy maintainers face a multi-quarter remediation cost cycle that compresses margins. Expect a concentrated wave of professional services, patching projects, and procurement of accelerated compute for offline red/blue testing — conservatively a high-single-digit to low-double-digit percentage lift in security-related cloud and GPU spend for the largest providers within 6–12 months.

A second-order supply-chain effect is the shift of vulnerability discovery from specialized human firms to commoditized model-driven tooling. That reduces the billable-hour upside for boutique red teams but creates durable demand for platforms that can integrate automated findings into CI/CD and patch orchestration (favoring companies that own both cloud hosting and devtool chains). Over 12–24 months, firms that can productize “model-in-the-loop” security workflows will capture recurring SaaS margins and cross-sell into existing enterprise contracts.

Tail risks cluster around two outcomes that would reverse the trade: (1) a high-profile uncontrolled leak of these capabilities that forces immediate regulatory limits on distribution, causing a sharp but transient rerating of AI/security exposure, and (2) rapid open-source replication that commoditizes defensive tooling and depresses pricing. Both scenarios can trigger 20–40% swings in vendor sentiment inside a 1–3 month window, so active hedging around major project milestones (public releases, demos, consortium reports) is prudent.

Key Decisions for Investors

• Long MSFT (6–12 month call spread; size 2–4% NAV): Rationale — Azure + Defender platform stands to capture accelerated enterprise security spend and integration projects. Structure as a 6–12M bull call spread to cap premium drag; target upside 15–25% vs limited premium loss (~100% of premium) if coordination/repair cycles underdeliver.
• Long NVDA (3–6 month call options or buy/write; size 1–3% NAV): Rationale — incremental demand for GPUs for offline red/blue testing and model evaluation should materialize quickly. Use call/calendar or vertical spreads to mitigate near-term IV; reward asymmetry ~20–40% if cloud/NDA compute bookings accelerate, downside limited to option premium.
• Long AVGO (9–12 month calls or stock, size 1–3% NAV): Rationale — enterprise software and infrastructure vendors with security product suites win recurring revenue from remediation and orchestration. Expect 12-month re-rating if cross-sell into installed base accelerates; hedge with a small put if regulatory headlines spike.
• Protective hedge: buy 1–3 month puts on AAPL or 1–3 month S&P index puts (size 0.5–1% NAV): Rationale — tail risk from an uncontrolled leak or regulatory shock could produce market-wide volatility and hit concentrated tech exposures. Cost is small insurance versus potential 20–40% downside in the event of systemic incidents.