Palo Alto Networks finds 75 vulnerabilities with Anthropic's Claude Mythos 5

  • Palo Alto Networks used Anthropic's unreleased Claude Mythos 5 to test internal infrastructure and later launched a subscription AI security service.
  • Mythos found 75 vulnerabilities across more than 130 products in roughly one month, versus fewer than five monthly discoveries normally, and generated working exploits in over 70% of internal evaluations.
  • The test led to 26 CVE fixes, while Anthropic's access restrictions and U.S. export controls highlighted the risks of AI-enabled vulnerability discovery and exploitation.

Palo Alto Networks CEO Nikesh Arora authorized an internal stress test of Anthropic's unreleased Claude Mythos 5 in April. Over roughly one month, the model identified 75 vulnerabilities across more than 130 products, compared with the company's usual discovery rate of fewer than five vulnerabilities per month; Arora said the weaknesses would have taken five to seven years to find manually. Mythos generated working exploits in more than 70% of Palo Alto's internal evaluations, although Arora separately estimated that about 30% of its findings were false positives, reflecting different performance measures. The test prompted 26 CVE fixes and helped underpin Unit 42 Continuous Frontier AI Defense, launched September 22 as an annual-subscription service combining Claude Mythos 5, OpenAI's GPT-5.6-Cyber and open-weight models with proprietary threat intelligence and specialist review. The service identifies vulnerabilities, assesses exploitability and recommends prioritized fixes, code changes and virtual patches. Palo Alto shares rose approximately 2.4% to $397.74 around 10:29 a.m. ET Wednesday after the launch, although AI costs, specialist reviews, renewals, service profitability, automation and valuation remain risks; GuruFocus said the shares were 70.08% above its $233.85 GF Value estimate and flagged six warning signs.

The information on this website is generated using AI and we cannot guarantee its accuracy. Please use it as reference information only.