Exclusive: Anthropic acknowledges testing new AI model representing ‘step change’ in capabilities, after accidental data leak reveals its existence

Anthropic is testing a new, more capable AI model (draft-named "Claude Mythos" / tier "Capybara") with early-access customers, and a misconfigured CMS left close to 3,000 unpublished assets publicly accessible. The company says the model is a "step change" vs Claude Opus 4.6 with materially higher performance on coding, reasoning and cybersecurity, but it is being rolled out cautiously and initially to cyber-defender organizations. The leak raises governance and reputational risk for Anthropic and highlights industry-wide dual-use cybersecurity concerns that could attract regulatory attention.

Analysis

Frontier-model improvements act like a demand multiplier for high-end compute and for telemetry-rich security stacks. If next-gen models increase per-inference compute or context window sizes by ~2-4x (a conservative engineering projection), hyperscaler GPU orders and data-center power budgets will re-accelerate within a 6–18 month procurement cycle, creating a pronounced capex leg for NVDA-exposed suppliers and their OEM partners.

The immediate cybersecurity externality is higher attack automation and scale: marginal attackers can run vulnerability discovery and exploit-creation pipelines at orders-of-magnitude lower cost, raising expected breach frequency and complexity. Insurers and in-house defenders will need more signal-rich, AI-aware detection, pushing incremental spend to vendors that can ingest large telemetry volumes and operationalize model-evaluated risk — expect pricing pressure on legacy appliance-heavy vendors and a re-rating opportunity for cloud-native security platforms over 12–24 months.

Regulatory and enterprise adoption dynamics create both a throttle and an accelerator: mandatory model audits, export controls, or certification regimes could delay commercial rollout by quarters but will also erect barriers to entry that consolidate market share among large cloud providers and compliance specialists. The most actionable second-order effect is a short window where enterprise customers pay a premium for “defender-first” access and model-hosting SLAs — monetizable by hyperscalers and security vendors able to provide turnkey, audited deployments in the next 3–9 months.

Key Decisions for Investors

• Long NVDA (6–18 months): Buy a 6–12 month call spread to capture renewed datacenter GPU demand driven by larger models. Risk: inventory correction/regulation; Target: 2x premium return if enterprise GPU orders re-accelerate within 6–12 months; stop-loss: cut at 50% of premium.
• Long CRWD (3–9 months) + Short FTNT (3–9 months) pair: Go long CrowdStrike equity or 3–6 month calls to play telemetry/ML-native detection, and short Fortinet to express downside in appliance-focused vendors as buyers shift to cloud-native stacks. Risk/reward: asymmetric — expect 20–30% relative outperformance for CRWD vs FTNT if breach automation rises; position size: small (1–2% portfolio) until post-earnings confirmation.
• Overweight MSFT (12 months) via calls or incremental long exposure: Capture premium for model-hosting, enterprise SLAs, and compliance tooling monetization. Catalyst window: 3–9 months as audited hosting contracts close; downside: regulatory clampdown on model commercialization.
• Buy exposure to specialist identity/compliance plays (e.g., CYBR/CyberArk or similar) with 9–18 month horizon: These vendors benefit from mandatory audits and identity-hardening spend. Use conservative option structures (debit spreads) to limit downside while capturing re-rating if regulatory/enterprise spend accelerates.