Anthropic: 6-12 months to fix AI-found software flaws

Anthropic CEO Dario Amodei warned there is a six- to 12-month window to address tens of thousands of software vulnerabilities uncovered by the company’s Mythos AI. He made the remarks during a roughly two-hour discussion with JPMorgan Chase CEO Jamie Dimon tied to Anthropic’s push into financial services.

At the event, Anthropic demonstrated AI agents for tasks such as pitchbooks, earnings review and compliance work. The company says Mythos can scan large codebases much faster than human researchers and has identified thousands of previously unknown weaknesses across widely used software. In earlier testing with Mozilla, an early version of Mythos flagged 271 potential vulnerabilities in the Firefox browser in a single pass.

In controlled experiments, Anthropic reports Mythos completed multi-step network attack simulations without human intervention, moving from discovery to exploitation in a single run. Access to the model is restricted to a small group of partners through a program called Project Glasswing. Many of the vulnerabilities the model finds remain undisclosed because they have not yet been patched.

Amodei warned that if flaws are announced before fixes are in place, malicious actors could exploit them. He also cautioned that the speed at which AI can find weaknesses could outpace how quickly organizations can respond, raising the risk of more breaches and financial damage from ransomware affecting schools, hospitals and banks.

Some security researchers have shown portions of Mythos’s capabilities can be reproduced using existing models and open-source tools, which could make similar functions more widely available sooner. Industry reaction has been mixed; OpenAI CEO Sam Altman characterized the public warnings as “fear-based marketing.”

Amodei did not raise details of the company’s ongoing legal disputes during the discussion. He described Anthropic as “good for this country” and urged clearer, consistent rules for companies working with advanced AI systems.

Anthropic says it is working through its partner program to fix vulnerabilities before any wider release of the capability. Amodei called for faster coordination across companies and institutions to patch the flaws the model uncovers, noting, “There are only so many bugs to find.”