Dario Amodei said Chinese AI models are 6 to 12 months behind Mythos, setting a deadline to patch tens of thousands of vulnerabilities
NurPhoto / Getty Images
Anthropic CEO Dario Amodei warned Tuesday that the gap between his company's most powerful AI model and comparable systems from Chinese competitors gives the world roughly six to 12 months to patch tens of thousands of software vulnerabilities the model has uncovered.
JPMorgan $JPM Chase CEO Jamie Dimon joined Amodei on stage at an Anthropic event in New York. Amodei explained that Chinese AI models are about six to twelve months behind Mythos, so defenders have that much time to act before others gain similar abilities.
The scale of what Mythos has found is significant. To illustrate how dramatically the threat has grown, Amodei pointed to Firefox: where a prior Anthropic model turned up around 20 flaws, Mythos surfaced close to 300 in that browser alone — and across all software, the cumulative tally now reaches into the tens of thousands. Releasing details about the flaws before patches exist would hand criminals a roadmap, Amodei cautioned, which is why the overwhelming majority have been kept out of public view.
Neither executive treated the threat as permanent. Amodei invoked a finite horizon — "There are only so many bugs to find" — while framing the current stretch as a "moment of danger" that, if handled well, leads somewhere better. Dimon echoed that outlook, calling AI-driven cybersecurity risk a "transitory period."
Anthropic has restricted Mythos to a limited group of partners because of concerns about criminal or state-level misuse. As Quartz previously reported, the company launched Project Glasswing, committing up to $100 million in usage credits to deploy Mythos exclusively for defensive security work among 12 launch partners — including Amazon $AMZN Web Services, Apple $AAPL, Microsoft $MSFT, Google $GOOGL, JPMorgan, and Palo Alto Networks $PANW — along with more than 40 additional organizations that build or maintain critical software infrastructure.
During testing, Anthropic used Mythos to find thousands of zero-day vulnerabilities across major operating systems and browsers, including a flaw in OpenBSD dating back 27 years and a separate vulnerability in the video processing library FFmpeg that had survived five million passes by automated testing tools. Notably, Anthropic said no specialized cybersecurity training went into the model — its ability to find vulnerabilities is a byproduct of general advances in coding and reasoning.
The threat prompted a response from U.S. financial regulators. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened bank CEOs — including the heads of Citigroup $C, Morgan Stanley $MS, Bank of America $BAC, Wells Fargo $WFC, and Goldman Sachs $GS — to discuss what Mythos and comparable models could mean for their exposure to attacks.
Regulation also came up, with Amodei drawing on the auto industry as his preferred analogy: meaningful safety checks, he argued, do not have to come at the expense of a functioning, competitive market. "You can't just start a car company without 'Are there brakes on this thing?'" he said, according to CNBC.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.
