Anthropic is giving companies, including Amazon, Apple, and Microsoft, access to its unreleased Claude Mythos model to prepare cybersecurity defense

Project Glasswing: Anthropic is providing preview access to its unreleased Claude Mythos model to roughly 50 tech, cybersecurity and critical-infrastructure organizations (including AWS, Apple, Google, Microsoft, NVIDIA, CrowdStrike and JPMorgan) to scan and secure systems; Anthropic says the Mythos Preview has identified thousands of zero-day vulnerabilities, including a 27-year-old OpenBSD bug. Following initial reports, shares of several security vendors fell roughly 5%–11%, and Anthropic warns Mythos materially increases the likelihood of large-scale AI-driven cyberattacks this year, creating sector-level downside risk for incumbent security products and potential implications for national security and critical infrastructure.

Analysis

Front-line consequence: models that reliably surface hard-to-find vulnerabilities reprice demand away from legacy signature/rule-focused vendors toward platform-level, inference-heavy solutions and managed services. Expect a 6–18 month transition where incumbent security point-products face margin pressure (we estimate 100–300bps of gross-margin compression) as customers migrate budget to continuous, AI-driven scanning and cloud-hosted remediation pipelines.

Second-order winners will be owners of ML inference stack and tooling (GPU suppliers, cloud hyperscalers, MLOps vendors) that monetize both compute and higher-ARPU managed offerings; they should capture the lion’s share of incremental spend because defensive tooling becomes a continuous service rather than a periodic product sale. Conversely, narrow detection/playbook vendors without native LLM integration are exposed to churn and loss of pricing power — this bifurcation will sharpen within 12 months and accelerate M&A of laggards.

Catalysts and tail risks are asymmetric: a high-profile, AI-enabled breach would turbocharge defense budgets and favor platform players, while model errors (false positives/negatives) or fast open-source replication could blunt vendor pricing power and democratize defenses. Regulatory intervention (export controls, liability frameworks) is a 3–12 month tail risk that would reroute investment flows and could temporarily benefit larger, compliance-oriented suppliers.

Tradeable timeframe is near-term volatility (weeks) into a structural re-rating over 6–18 months; best execution will come from risk-managed pairs that long AI/infra exposure and short vulnerable niche security vendors, plus optionality to capture convex upside from accelerated enterprise AI spend or downside from a regulatory shock.

Key Decisions for Investors

• Pair trade (6–18 months): Long NVDA (or deep-in-the-money calls) 4–6% net exposure vs short CRWD 2–3% exposure. Rationale: NVDA captures incremental inference spend; CRWD is a pure-play with greater execution risk. Risk/reward: target +40% on NVDA leg vs 30% downside protection on short CRWD; stop-loss if pair moves >15% adverse.
• Long MSFT or GOOGL (12 months): Buy 12-month calls or add 3–5% weight to each; cloud hyperscalers will reprice higher as customers buy managed defensive services. Risk/reward: asymmetric upside (25–35% base case) with limited downside if sized to 3–5% AUM and hedged with short-dated puts sized to 50% of notional.
• Tactical short (3–9 months): Short PANW or ZS via Jan 2027 puts or small-cap short — target 20–35% downside if adoption accelerates and price competition increases. Use a 10–12% trailing stop or hedge by buying cheap calls to cap tail risk from defense spending surprise.
• Contrarian hedge (6–12 months): Buy OKTA or TENB 9–12 month calls as a tail-protection/alpha kicker (1–2% allocation). Rationale: identity and vulnerability management can become sticky, creating upside if enterprise spends pivot to integrated security suites after a breach. Risk/reward: asymmetric payoff if market rotates back into defensive, limit allocation to preserve portfolio gamma.
• Event-driven option (weeks–months): Buy out-of-the-money calls on NVDA or MSFT ahead of major earnings/cyber incidents (small size, 0.5–1% AUM) to capture convex upside from accelerating AI spend; cap loss to premium paid and avoid carry into long-dated regulatory uncertainty.