Opinion | After Mythos, the Future of the Internet Is At a Crossroads

Last week, Anthropic announced that its newest artificial intelligence model, Claude Mythos Preview, would not be released to the public, after the company learned it was capable of finding and exploiting vulnerabilities that have gone undetected in critical software systems for decades. Instead, Anthropic gave access to Mythos — and $100 million in credits to use it — to more than 50 of the world’s largest organizations, including Amazon, Apple, Microsoft, Google and JPMorgan Chase, as part of a defensive cybersecurity initiative called Project Glasswing.

Even before the announcement, publicly available A.I. models were already finding security vulnerabilities in commonly used software. Anthropic’s researchers acknowledged that other labs are six to 18 months from building something comparable. These capabilities, and the threats they pose to cybersecurity, will proliferate. From streaming platforms to online banking services to search engines that answer everyday questions, broad swaths of the internet could become unusable.

If we don’t respond carefully and decisively, then the millions of people who stand to gain the most from A.I.’s progress as a programming tool will also be the ones most exposed to attack. Leaving them to fend for themselves could erode the internet as we know it.

You might already be familiar with the concept of vibe coding: using A.I. tools to turn plain-language descriptions into working software. A shop owner describes the inventory system she needs, and A.I. creates it. A dentist describes a patient portal, and A.I. delivers it. Millions of people who never thought of themselves as software developers — small business owners, clinicians, nonprofit directors — are creating software for the first time without any training. But these applications are often written without security review. Potential flaws, increasingly easy to find as A.I. improves, could let someone access customer data, take over accounts or shut the entire application down.

For decades, two kinds of scarcity kept the internet safe — or safe enough. Writing software was hard, so the people who did it were trained, careful and few. Finding bugs was also hard, so the worst flaws stayed hidden, sometimes for decades. It wasn’t a great system. But the difficulty on both sides created a kind of détente that held.

Now, thanks to new A.I. tools, anyone can write code. Soon, bad actors could use those same tools to find out what’s wrong with code. The détente is over.