A new AI model
AI refers to computer systems that can perform tasks normally requiring human intelligence, such as visual perception, speech recognition, decision-making and translation between languages. The latest models – known as Frontier AI – excel in advanced reasoning and autonomous task execution.
Frontier AI and cyber security
Among the use cases for Frontier AI is the ability to efficiently discover vulnerabilities in software. Although this is useful for software developers, unfortunately, malicious actors will also be able to use these newly found vulnerabilities to exploit systems at a greater speed and scale than ever before. Frontier AI models look set to change the threat landscape for organisations considerably.
One of the new Frontier AI models attracting attention from cyber security experts is Anthropic’s product Claude Mythos Preview. As an agentic model (AI models that can perceive, reason, plan and act independently to achieve specific goals) Mythos Preview can autonomously complete a series of tasks. For instance, Anthropic says it can identify zero-day vulnerabilities in code and then weaponise them into fully working exploits.
Mythos has already found thousands of serious vulnerabilities including in major operating systems and web browsers. Anthropic has launched Project Glasswing to work with leading technology developers and cyber security agencies to prepare the industry for the advent of these new models.
Protection from AI exploits
The best defence against these exploits continues to be effective security controls. Organisations are recommended to review their current security positions to ensure that they remain fit for purpose and appropriate methods are used to detect and contain any malicious activity.
On the positive side, AI can assist network defenders in their work and increase their ability to protect systems at scale and pace. For example, defenders can use AI to check their own code for vulnerabilities and consider how frontier models can be used to strengthen code before it is deployed into production.
The NCSC has published guidance for cyber defenders and for business leaders to help them understand the risk of frontier AI products like Claude Mythos Preview. We will continue to do so as the landscape changes and new information comes to light.