Mythos-class AI models pose significant threats to privacy and data protection

The emergence of Anthropic's Claude Mythos artificial intelligence (AI) model and its consumer-facing version, Fable, underscores significant privacy and data protection risks, as well as misinformation about the security of digital infrastructure. Privacy in today's society relies on the premise that software systems can secure personal communications, financial data, and health records. The introduction of Mythos-class models significantly lowers the barriers to discovering software vulnerabilities.

Unlike human researchers, these models can continuously analyse complex codebases. This accelerates the scale and speed of vulnerability discovery, increasing the likelihood of population-scale personal data breaches, unauthorised surveillance, and the exposure of sensitive communications. The threat is magnified as governments increasingly create centralised databases for digital identity, public service delivery and other national-scale databases. 

These capabilities challenge legal data protection frameworks, such as the EU and UK General Data Protection Regulations (GDPR), as standard technical measures and risk assessments may no longer suffice in the face of a rapidly accelerating threat landscape. Furthermore, open-weight models are likely already capable of replicating these capabilities, meaning temporary restrictions by Anthropic and blunt interventions by the US government offer limited long-term protection. Ultimately, the situation exposes a critical gap in data protection regulation, underscoring that neither corporate-led decisions nor reactive government restrictions provide a legitimate, democratically grounded solution for safeguarding public data.

Training Announcement: Find out more about our range of independent accredited data protection and AI governance qualifications from IAPP and BCS.