US suspends two AI models after cyberattack vulnerabilities exposed

The US government has suspended two advanced AI models after researchers demonstrated their potential use in cyberattacks. Claude Mythos and Fable 5, designed for cybersecurity defence, were found capable of identifying vulnerabilities in open-source projects at an unprecedented scale. Anthropic first released Claude Mythos in April 2023, followed by Fable 5 and Mythos 5 in June 2023. These frontier AI models can scan major open-source projects and uncover multiple vulnerabilities in a single pass. Both defenders and attackers can access these tools for vulnerability discovery.

To address the growing challenge, Akrites was launched by the Linux Foundation. It serves as a coordinated body for handling vulnerability discovery, remediation, and disclosure in critical open-source software. Akrites’ Security Incident Response Team consolidates findings, validates genuine vulnerabilities, and manages a single coordinated fix and disclosure process. Its founding members include AWS, Anthropic, Google, Microsoft, OpenAI, Cisco, Red Hat, NVIDIA, Chainguard, Sonatype, Ericsson, Vodafone, Citi, and JPMorgan Chase.

Jason Clinton, deputy CISO at Anthropic, argues that the existing model for coordinated disclosure has been outpaced by AI's ability to find vulnerabilities. Varun Badhwar, CEO of Endor Labs, reports that AI tools have surfaced thousands of validated open-source vulnerabilities in recent months, with fewer than 5% patched. JPMorgan Chase CISO Pat Opet emphasises that success should be measured by fixes reaching live systems, not just by patches being published. The suspension of Claude Mythos and Fable 5 highlights the dual-use nature of AI in cybersecurity. Akrites and its members are now working to streamline vulnerability management. The goal is to ensure that discovered flaws are addressed and deployed in live environments as quickly as possible.