AI hacking tools like Mythos can be 'net positive' says top cyber official

UK cyber chief Richard Horne says frontier AI tools like Anthropic's Mythos could be a "net positive" for public cyber-security if secured from misuse, while urging firms to strengthen basic defenses and follow new European safety guidelines. The article highlights rising concern over AI-enabled hacking, with Anthropic restricting access to Mythos and the UK government pressing AI firms to support national cyber-defence capabilities. The broader backdrop is escalating nation-state and hacktivist cyber risk, especially from Russia and China.

Analysis

The market is likely underpricing the second-order effect: regulated enterprises will treat frontier AI not as a generic productivity tool but as a security budget shock. That benefits vendors selling identity, endpoint, network segmentation, vulnerability management, and AI governance, because the near-term buyer response is defensive spend rather than broad experimentation. The biggest winners should be firms that can prove closed-loop detection and response inside regulated environments; the losers are point-solution security names without workflow integration or cloud-scale distribution.

This is also a catalyst for a procurement reset over the next 1-3 quarters. If AI materially lowers the cost of finding exploitable weaknesses, boards will accelerate legacy system replacement and multi-factor/privilege hardening, which should extend the runway for infrastructure modernization and managed security services. A less obvious knock-on: cyber insurance pricing may stay sticky or re-rate higher despite improving tool quality, because insurers will assume attack frequency and speed rise faster than average defense efficacy.

The contrarian view is that headline fear may be overstated relative to actual monetization. Many enterprises will respond by restricting AI usage rather than buying new tech immediately, which could delay budget conversion and create a near-term air pocket for vendors selling pure AI security narratives. The real inflection is not the model release itself but whether governments force compliance standards that convert voluntary spending into mandatory spend; that would be the trigger for a multi-quarter re-rating.

Tail risk is concentrated in a single major breach that proves AI-augmented exploitation scales faster than patch cycles, especially in critical infrastructure or financial services. That would likely pull forward spending, increase regulatory pressure, and widen the valuation gap between platform security leaders and smaller names. Conversely, if model access is tightly gated and no large public incidents emerge over the next 6-12 months, the fear premium could bleed out and leave only steady, not explosive, demand growth.

Key Decisions for Investors

• Go long PANW vs. short a basket of lower-quality point security names over the next 3-6 months; PANW is better positioned to capture board-level consolidation spending if frontier-AI risk drives platform buying, while smaller vendors face budget scrutiny and slower deal cycles.
• Buy CRWD on pullbacks for a 6-12 month horizon; if AI threat perception accelerates endpoint and identity spending, CRWD should see durable seat expansion and higher module attach, with asymmetric upside versus limited balance-sheet risk.
• Express the theme through FTNT or NET only on weakness and only tactically; both can benefit from increased traffic/security demand, but execution risk is higher, so use them as short-duration trades rather than core longs.
• Pair long DLR / EQIX against short software names with weak security moats if you expect a compliance-driven infrastructure refresh cycle; regulated customers will need secure colocation/connectivity before they modernize workloads.
• For event-driven positioning, buy 3-6 month call spreads in CRWD or PANW ahead of any UK/EU regulatory follow-through; the best risk/reward comes if policymakers convert AI-cyber rhetoric into mandated spend.