A fierce debate is unfolding in artificial intelligence over whether clamping down on a single powerful model can actually contain the danger it poses. Anthropic's models sit at the center of that fight, but security experts are blunt: the real problem stretches far beyond any one company.
A double edged capability
Since Mythos debuted in April, Anthropic has both touted and warned about the same thing. Its model is skilled at hunting down software vulnerabilities, which on one hand helps defenders patch them, and on the other hand can surface ways to exploit those same flaws, methods that bad actors could put to use. The company flagged this double edged nature when it launched Mythos 5 and Claude Fable 5.
In a blog post last week, Anthropic wrote, "A great deal of advanced usage of AI models is dual use: the same queries that are beneficial in the hands of cybersecurity professionals and biology researchers could be dangerous if available to malicious actors."
From a closed circle to a public model
With that risk in mind, the company first handed a version called Mythos Preview to a select consortium that was part of a working group known as Project Glasswing. Mythos 5 was likewise released privately to this group last week. Claude Fable 5, which is a Mythos-grade model, went out to the general public instead, but with specific blocks on its ability to answer questions about biology and cybersecurity.
The Trump administration steps in
Then, at the end of last week, the Trump administration moved to restrict both models. The administration believes that Fable 5's guardrails can be disabled to unlock full access to the Mythos 5 capabilities, allegedly turning it into a national security risk.
Why experts call the ban shortsighted
Experts argue, however, that this institutional clash is merely delaying or masking a hard truth. Anthropic may be the tip of the spear right now, but AI capabilities in general, and models from multiple companies and open-weight developers, will almost certainly reach something like Mythos 5 in the near future, if they have not already.
"It's myopic in the extreme to think that no other competitors to Anthropic will develop similar capabilities to Mythos or even that they have not already done so," says Tarah Wheeler, chief security officer of the specialized cybersecurity consulting firm TPO Group. "There are other companies hot on Anthropic's heels who probably have the capabilities, too, and are holding them in reserve as they see how Anthropic is being treated in the current regulatory environment."
Anthropic itself has stressed this point ever since Mythos Preview arrived. "The real message is that this is not about the model or Anthropic," Logan Graham, the company's frontier red team lead, told TrendKia when Mythos Preview launched in April. "We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months."
Not one model, but a whole trend
OpenAI, for instance, also carried out a private release of a cybersecurity-focused model in mid-April and announced an expanded cybersecurity strategy.
Researchers point out that even before this next generation of models, today's AI offerings could be wired up with a refined harness to do advanced vulnerability-hunting and exploit development. A large group of cybersecurity leaders pressed this very argument on the administration in an open letter on Sunday, contending that the White House's export-control directive was misguided.
"It's not one model; it's the general trend of technology," says Bruce Schneier, a researcher at Harvard University and the University of Toronto who has been analyzing the situation. "Smaller, cheaper, open-source models, sometimes by themselves and sometimes in concert with each other, can match Mythos/Fable's performance with more sophisticated prompting. And we should expect other models to match Mythos/Fable's creativity and tenaciousness within months, slightly longer for open-source models."
The real policy question
What the White House and governments worldwide should focus on, experts say, is democratically building far broader and more transparent plans for handling advances in AI capabilities across cybersecurity and other sensitive areas, since those advances are bound to arrive.
"The policy question is not whether a technology has risk," says Chris Wysopal, cofounder of the cloud security firm Veracode. "The question is whether a specific restriction meaningfully reduces that risk or whether it mainly slows down the people trying to make systems safer."
