I'm Kevin Roose, a tech columnist at the New York Times.
I'm Casey Newton from Platformer, and this is Hard Fork.
All right, Casey, we are going to talk about Claude Mythos Preview, the new scary, dangerous, unreleased model from Anthropic that has the whole cybersecurity world on edge. We'll talk about Project Glasswing, which is their attempt to give the good guys a head start in using this model to secure the internet before the bad guys get it, and what it all means. And we're going to release this ahead of our normally scheduled episode.
We couldn't hold it back any longer. Yeah.
And tomorrow we'll release the rest of the show, including our interview with New Yorker writers Ronan Farrow and Andrew Marantz on their spicy new profile of Sam Altman.
You don't have any disclosure merch to my knowledge. So I had these made for you.
Plus one of our favorite segments, One Good Thing. Well, Casey, as you know, on this podcast, we have a rule about discussing AI models called Ship It or Zip It.
Ship It or Zip It. Unless you're actually putting it in people's hands, we usually do not want to hear about it.
Yes. But today, we are making an exception for the new Anthropic model, Claude Mythos Preview, that just was announced but not released to the public for reasons that we will talk about. But first, since this will be a segment and a show about AI, our disclosures. I work for the New York Times, suing OpenAI, Microsoft, and Perplexity over alleged copyright violations.
And my fiancé works at Anthropic.
Casey, this is, I want to say, like the biggest story of the year in AI. I know there's been a lot of AI news. I know that people are probably saying, 'Oh, here they go talking about another model.' Again, I am telling you this is something that people need to be paying attention to because of the implications, because of the way it was rolled out, and because of the model itself, which we will get to all of that. But do you agree that this is a big deal?
Well, you know, when we were talking about the show this week and we were kicking around the idea of like, hey, exactly how big do we think this is? You pointed out that one question people have been asking this week is, are we going to have to rewrite all software? And I feel like usually when folks are kicking that question around, it's a big story.
Yeah. So this has been, just for a little bit of background here, there have been rumors for weeks now about some new incredible model that Anthropic had cooked up.
And in part those rumors emerged when there was a leak of a blog that the company had drafted to talk about this model that happened about two weeks ago, and so people have been buzzing ever since.
So let's just talk through what was actually announced this week. So on Tuesday, Anthropic announced that it was starting something called Project Glasswing. I got to interview some executives over there about this. They told me that the name Project Glasswing refers to the glasswing butterfly, which has transparent wings and so it can hide in plain sight, and that is thematically important for reasons that we will come back to.
It's also a delicacy in some countries.
I've never had glasswing butterfly.
So notably, they are not releasing this model to the public because they claim it is too dangerous to do that. Instead, they are giving access to a consortium of tech companies including Cisco, Broadcom, sort of makers of internet infrastructure, as well as Microsoft, Apple, Amazon. Basically every big tech company that is not OpenAI or Meta is getting access to this model, but not general access, just access to do defensive cybersecurity testing, basically to go out and harden their systems and their infrastructure and their software before the general public can get its hands on this model. So what are some examples of what Mythos was doing in training that so alarmed Anthropic that it came to this point?
So Anthropic has been running this model internally for several weeks now, and they claim that this thing has found vulnerabilities in every major operating system and web browser. They gave some examples that have already been patched. One of them was that this model apparently found a 27-year-old security flaw in OpenBSD. OpenBSD is an open-source operating system that runs on firewalls and routers. It is sort of like a critical security layer on the internet, and it was designed specifically to be hard to hack, right? And this model, because of its advanced coding and reasoning capabilities, was able to find this bug that 27 years' worth of professional security researchers had not been able to find.
Another example was that it found a bug in a piece of popular open-source video software called FFmpeg that runs on a bunch of different services. That had, according to Anthropic, been scanned for bugs 5 million times by automated security tools without finding this critical exploit.
And that's why it's important to always look the 5 million and first time because you might find something. Now, Casey, I think for people who are not cybersecurity experts, it might be worth sort of sketching the context here for like how software works.
