The world of Mythos: Need for structures to ensure governance, regulation

The recent release of Claude Mythos Preview (CMP) and the decision of its creator, Anthropic, to restrict access to the new model highlights a qualitative jump in artificial-intelligence (AI) capabilities and the new opportunities and dangers those capabilities create. CMP can autonomously audit all kinds of software, including operating systems and legacy programmes. It can identify bugs and vulnerabilities at an unprecedented scale and has reportedly discovered thousands of unknown flaws in commonly used operating systems. It could, in theory, be deployed to exploit such “zero-day” vulnerabilities, again at an unprecedented scale. It could also be used to preview and audit new programmes for vulnerabilities to ensure they are bug-free and secure.

 

When Anthropic realised the capability of the new model, it acknowledged CMP was too dangerous for general release. Access to CMP is now restricted to a limited group of vetted organisations under what is called Project Glasswing. Under the project, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, and other information-technology (IT) companies will collaborate to test and deploy CMP but the model will not be released to the general public. Central banks and government institutions too may access the model, which is cause for concern since governments do indulge in cyberwarfare. The caution signals that AI now falls within the narrow category of technologies that require not only regulations but stringent governance structures and access restrictions. As with nuclear energy, aviation, and certain military technologies, safety, control, and oversight must be established before any large-scale deployment of CMP.

 

CMP alters the way the software industry works. In future, cybersecurity cannot be about defending systems against bad actors. It basically becomes the management and control of AI, which can autonomously discover and exploit vulnerabilities. The ways in which systems are debugged change completely. Instead of individual humans reviewing code, line by line, and occasionally finding a bug that could be patched or exploited, CMP can review entire operating systems five million times within a week. Finding bugs is no longer a major problem under the new paradigm. Cybersecurity at this pace and scale is entirely about AI deployment. Both attack and defence will be performed by AI and scaled through computational power. Anthropic suddenly becomes one of the world’s most important cybersecurity companies, being pitchforked into an entirely new role. The IT industry has always released “beta” software and reviewed user-feedback to improve performance and security of the said software. That also changes. Project Glasswing indicates new AI models should now undergo rigorous testing and certification and face continuous monitoring instead of being deployed “as is” for the world at large to discover capabilities and flaws. This is how, for example, aviation works, because of the obvious dangers.

 

However, CMP also demonstrates that new models and software can be quickly and rigorously tested for flaws. Management theorists would call this a move towards anticipatory governance, and Project Glasswing repositions the collaborators in the project as risk managers rather than as just tech providers. Another deeper, broader concern is systemic. Every sector and industry is vulnerable to CMP, or some similar model. AI developers, security researchers, regulators, and industries must now collaborate. Since CMP exists, similar models will soon be developed elsewhere. Structures must be created to ensure the governance and regulation of such models before they start being deployed at scale, as is inevitable.