In March 2016, Google's AlphaGo program played Move 37 against Lee Sedol, one of the world's best Go players. The move defied all established wisdom, and the experts thought it was a mistake. It turned out to open up strategies that no human had discovered in the game's 5,500-year history. AlphaGo had found lines of reasoning we could barely follow.
Now something similar appears to have happened in IT security. Anthropic has developed Claude Mythos Preview. Some of the model's reported achievements:
- Found a 27-year-old hole in OpenBSD, infrastructure that powers firewalls and network equipment around the world
- Found a 16-year-old bug in FFmpeg, the open-source tool behind virtually all video streaming on the internet: YouTube, Netflix, Chrome, Android, VLC
- Built working attack code against Linux and web browsers, on its own, in a matter of hours
- Broke into Firefox 181 times in one test. Claude Opus 4.6, last month's model (!), managed it twice in the same test.
Anthropic did not specifically train the model to look for security holes. The capability emerged as an unexpected consequence of the model becoming good enough at coding and reasoning in general. Anthropic has not released the model. Instead, it is being used defensively through Project Glasswing ↗, to plug holes in critical infrastructure before anyone else finds them. Sensible.
In practice, this means three things have already changed for anyone responsible for digital infrastructure:
- Friction counts for less as a defence. Much of today's IT security relies on attacks being time-consuming. Programs like Mythos do not tire. Either you find the hole yourself, or someone else gets in through it.
- The patch window is shrinking. The time from vulnerability to working attack is dropping from weeks to hours. That turns long patch processes into a strategic problem. Discovery and patching will probably need to merge completely.
- The bottleneck is shifting. Finding vulnerabilities used to be the hardest part. Now AI does it quickly and systematically. The new problem is triage: which holes are most critical, in what order do they get fixed, and who has the mandate? Organisations that do not start using AI systematically in their cybersecurity work will find it hard to keep up the pace required.
Mythos also has geopolitical implications. Europe is in much the same position as the Go world after 2016, except that the board is the whole of society. If a capability of this kind exists and is controlled by actors outside Europe, what does that mean for us? Are we to become customers, buying security solutions against a threat we cannot analyse ourselves? We risk becoming consumers in a monopoly market.
Europe has a great deal to offer that is becoming scarce in the rest of the world: strong academic institutions, democracy and welfare. An expanded European AI initiative that makes those core values its selling point, and is properly resourced, could be our smart countermove. Our winning move. Move 38.