The Future of Cybersecurity Is AI Against AI

For years, cybersecurity was based on a comforting fiction: attacking complex systems required talent, time, patience and in-depth knowledge. Advanced attacks were scarce, expensive and limited by a human variable: fatigue. Hackers had to be able to read code, understand architectures and test their hypotheses repeatedly. That friction never guaranteed safety, but it maintained a certain balance.

That balance is now being upended. Not because an evil AI has appeared, but because the search for vulnerabilities no longer depends on human patience. A model doesn’t get bored, frustrated, or tired of looking at the same task from a hundred different angles. It can fail thousands of times and keep trying combinations until it finds a crack. Infinite patience is one of the most disturbing properties of automation.

That’s why models like Claude Mythos matter far beyond their name. Anthropic created Project Glasswing to give critical organizations a defensive advantage using by Claude Mythos Preview. It makes sense: if a model can find vulnerabilities before attackers do, why not use it to fix them? But that same capacity can also be offensive. The tool that discovers a backdoor can exploit it. The frontier is not in the model, but in who uses it and the incentives involved. In fact, China says it already has the tools to counter Mythos.

The Five Eyes global security alliance recently warned that AI capable of bringing down governments is just months away. Rather than an apocalyptic prophecy, this should be seen as the realization that the clock is ticking faster. When intelligence agencies start talking in terms of months, they’re admitting that the Western monopoly on these capabilities may be short-lived. Britain’s AI Security Institute cites significant improvements from Claude Mythos Preview, such as chat-based probing, capture-the-flag challenges and multi-step cyber-attack simulations. It is not the same as compromising a well-defended critical infrastructure, but what works today in a controlled environment appears in accessible tools tomorrow.

The Google Threat Intelligence Group has already described this transition to an industrialization of cyberattacks, with adversaries using AI to exploit vulnerabilities and initial access. There is no need to believe in omnipotent machines when marginal costs fall dramatically. Cybercriminals no longer need to be geniuses; it’s enough to formulate targets, chain tools, and then let the system work.

Anybody who believes Mythos can be stopped is deluding themselves. A model can be slowed down or temporarily classified, but capacity will shift to other models, other countries, and sooner or later to open versions. As Bruce Schneier explains in his analysis of Fable: the problem is not the product per se, but the general trend of ever-increasing capacities. The White House executive order on innovation and security in advanced AI confirms that reading: frontier models are already treated as strategic technology, not just software.

For Europe, the conclusion is uncomfortable. Relying on US models to defend banks, hospitals, energy grids or public administrations is not a strategy, it’s subordination. If access to critical capabilities can be conditioned by Washington, European technological sovereignty is more talk than reality.

The coming hybrid war will not necessarily be a cinematic blackout. It will be something more viscous: constant attempts on small suppliers, municipalities, hospitals, universities, supply chains, forgotten libraries, abandoned firmware and obsolete industrial systems. It will not be necessary to destroy everything. It will be enough to degrade trust, increase the cost of operating, manipulate data and force everything to be defended, all the time. Academic research, with benchmarks such as Exploit Gym, points in the same direction: although exploiting vulnerabilities is still difficult, frontier models already achieve non-trivial results. In cybersecurity, that is enough.

Organizations looking to defend themselves will have to use AI against AI. As BCG points out when talking about cybersecurity at the speed of AI, the challenge is not only technological, but also organizational. Knowing what systems you have, what dependencies you use, who accesses what, what you can isolate, and what you can recover will no longer be an occasional audit but an ongoing function.

The question isn’t whether Mythos should scare us. The question is whether our institutions are prepared for a world in which finding vulnerabilities becomes a permanent, automated and distributed activity. The honest answer is no. We continue to think of walls when we should be thinking of immune systems. We are still trying to stop the river when we should be redesigning the city to coexist with the flood. The river is already receding, and the question is who will build dikes, who will continue to sell umbrellas, and who will find out too late that they live in a flood zone.

(En español, aquí)

—

This post was previously published on MEDIUM.COM.

—