Cybersecurity’s Next Challenge Is Too Much Security

On the evening of 12 June, Anthropic received a letter from the US Commerce Department and, within hours, switched off its two most powerful AI models for most of the planet. The order, citing national-security authorities, barred any foreign national from using Mythos 5 or Fable 5, whether abroad or in the United States, and even extended to the company’s own non-citizen staff. Anthropic complied and called it a misunderstanding.

What made two language models subject to export controls was what they could do to software. Two months before, in April, Anthropic had taken the unusual step of not releasing its most capable system at all. It placed Claude Mythos Preview inside Project Glasswing, a coalition built with Apple, Google, Microsoft, Cisco, Broadcom, Palo Alto Networks, and more than 40 other organizations, and handed them the model to find and patch flaws before attackers could. According to the company’s account, it had already identified thousands of high-severity vulnerabilities, some of which had gone unnoticed for years in every major operating system and web browser.

Not every one of those claims is settled. Independent researchers, including Luta Security’s Katie Moussouris, have questioned how far the demonstrated capability actually exceeded existing tools. The part that matters for business is simpler. One of the world’s leading AI labs decided these capabilities were real enough to lock down, and the US government decided they were dangerous enough to control. For the Indian cybersecurity industry, which has grown into a $4.46 billion export business largely by identifying threats, that pairing lands close to home.

The real change underneath the headlines is economic. For as long as the industry has existed, finding a serious vulnerability has been slow, skilled and costly work, which is precisely what most security companies were built to sell. Let machines do it cheaply and at scale, and the scarce resource stops being a discovery tool. It becomes judgment, the ability to decide which of thousands of findings is worth acting on.

Kunal Ruvala watches this from closer than most. He runs India for Palo Alto Networks, one of the firms inside Project Glasswing, so his teams have already put a Mythos-class model to work on live+ code. He describes the shift without melodrama. “The industry is not being reshaped because AI has suddenly invented an entirely new category of attack,” he says. “It is being reshaped because it is accelerating the old game so dramatically that many existing security assumptions start to break.”

Discovery Is Getting Cheap. Judgment Is the New Bottleneck.

For decades the industry measured itself by what it could find. Companies sold threat intelligence, endpoint monitoring, penetration testing and vulnerability assessment, all of it built on the premise that weaknesses are hard to spot. Ruvala thinks that the premise is about to give way. “Over the next 12 to 18 months, the single biggest shift will be how the industry deals with a sharp increase in vulnerability discovery and the consequences that follow from it,” he says.

The consequences are the problem. Every vulnerability that surfaces creates work that did not exist the moment before. Someone has to judge how severe it is, test whether it can actually be exploited, weigh the damage it could do and coordinate a fix. Security teams are already drowning in the alerts they have. A model that multiplies the supply does not hand them an answer. It hands them a longer queue.

The harder part is not the volume. It is that the newest models grasp how flaws combine. A misconfiguration that looks harmless on its own can turn dangerous once it is chained to a weakness three systems away, and several minor flaws can assemble into an attack path far worse than any of them alone. “The industry will need to prioritize based on real-world exploitability, attack paths and business impact rather than treating every vulnerability the same,” Ruvala says.

This is the paradox the Mythos episode lays bare. Security teams spent years complaining they could not see their own threats. AI is about to let them see almost everything, and that turns out to be its own kind of trouble. A flood of intelligence is no easier to act on than a drought.