How dangerous is Anthropic’s Mythos AI? | Bruce Schneier

Anthropic’s Claude Mythos Preview was described as highly effective at finding software vulnerabilities, with the company limiting release to select customers because of cost and capability concerns. The article argues that comparable AI systems from OpenAI and others could intensify both offensive cyberattacks and defensive patching, with Mozilla reportedly using Mythos to identify 271 Firefox vulnerabilities. It also extends the risk beyond software to tax and regulatory loopholes, implying broader long-term productivity gains but a more dangerous near-term security environment.

Analysis

The investable shift is not “AI improves cybersecurity” but “attack-cost collapses faster than defense budget cycles.” That creates a short-term asymmetry for any incumbent whose product relies on human review, ticket triage, or slow patch cadence: attackers can operationalize model output in days, while enterprise remediation, procurement, and policy enforcement still move in quarters. The first-order beneficiaries are vendors that sell automated detection, patch orchestration, identity hardening, and cloud-native controls; the first-order losers are firms exposed to legacy software maintenance, unmanaged endpoints, and compliance-heavy workflows that look secure on paper but are slow to adapt.

A more subtle second-order effect is margin pressure on cybersecurity vendors themselves. If model-driven vulnerability discovery becomes commoditized, point solutions that only “find issues” will face pricing pressure, while platforms that close the loop from discovery to remediation should gain share and expand wallet share. This argues for differentiation between AI-assisted offense and AI-assisted defense: the market may overestimate the beta of pure offensive tooling and underestimate the durability of workflow-integrated defense software.

The longer-horizon implication is regulatory and tax-code arbitrage. AI doesn’t need to be perfect to create value; it only needs to systematically surface edge-case exemptions faster than regulators can respond. That is a multi-year structural challenge for governments, which suggests rising demand for tax-compliance automation and legal-tech workflow tools, but also a growing political tail risk: once AI-enabled loophole discovery becomes visible, lawmakers may move to simplify codes, cap deductions, or add anti-abuse rules, compressing the value of “clever optimization” over time.

Consensus is probably too focused on headline cyber risk and not focused enough on the patching dividend. In the near term, the increase in discovered vulnerabilities can actually boost demand across the security stack, especially for firms selling remediation, endpoint control, and identity. The overdone view is that every AI security breakthrough is purely bearish; the underdone view is that the winners will be the platforms that industrialize fixing, not just finding.

Key Decisions for Investors

• Long PANW / short a basket of legacy services-heavy security names for 3-6 months; PANW benefits from remediation-led platform spend while services-centric models face AI-driven pricing pressure. Target 15-20% relative outperformance, stop if enterprise budget commentary weakens sharply.
• Long CRWD on 6-12 month horizon as endpoint/identity hardening becomes a must-buy category; use call spreads to capture upside with defined risk. Risk/reward favors continued multiple support if breach headlines accelerate and remediation budgets rise.
• Long NOW or GTLB as AI increases ticket volume and patch workflow automation demand; these are the picks-and-shovels for closing vulnerabilities, not merely discovering them. Consider staggered entries after any post-earnings pullback for better entry points.
• Long INTU / HLT-style compliance-software exposure and short software firms with high legacy code exposure if AI tax/regulatory loophole discovery becomes a broader narrative over 6-18 months. The thesis is that compliance automation is a budget winner while exposed incumbents face higher remediation and legal costs.
• Avoid or underweight pure-play offensive cybersecurity tooling vendors until valuation resets; the market may overcapitalize the novelty of AI-led vuln discovery while ignoring commoditization risk. Use any hype-driven run-up as an opportunity to trim.