What Claude Just Did Is Insane (Investors Aren’t Ready)

Table of Contents

1. Introduction to Mythos
2. How Mythos Works
3. Impact on Cybersecurity
4. Investment Opportunities

Introduction to Claude Mythos

An AI model just found serious security flaws in every major operating system and web browser on earth. One flaw was hiding for 27 years inside one of the most secure systems ever built. Automated tools scan that code 5 million times and they never caught it. But here's where things get really crazy. The company that built this AI decided that it was too dangerous to release. So instead, they gave it to 12 of the most powerful companies on the planet, almost all of which we can invest in. My name is Alex and I spent 8 years as a radar engineer and AI researcher at MIT, and I've never seen AI do anything like this. So follow TickerSymbol: YOU and let me show you what just happened, and how I'm investing in it. Your time is valuable, so let's get right into it.

There's a piece of software that's so foundational that it powers almost every video you've ever watched online, including this one, it's called ffmpeg and it had a bug.

It used two different kinds of counters that didn't quite line up under one very specific condition, a frame carefully split into exactly 65,536 tiny pieces, that's 2 to the 16th power.

Those counters would collide when that happens, and when that happened, the software could write data outside of the memory it was allowed to touch, which opens the door for attackers to take control of the machine running the video, that's your pc or your smartphone if you're the one playing that video.

But it's also the enterprise servers that are processing it, netflix, apple, youtube, that bug was introduced in 2010, for 16 years automated testing tools saw that same line of code, 5 million scans.

Every single one missed it. And the reason is simple. Traditional tools throw random inputs at software and wait for it to crash. But this bug only triggers at one specific number. A random number tester would almost never find it. But this AI read the code, found the flaw, generated a custom test for it, and confirmed the bug on its very first try. This isn't a specialized cybersecurity tool. It's not a model that's trained to hunt vulnerabilities. It's a general purpose language model called Claude Mythos, built by a company called Anthropic. And here's why that matters for investors. Anthropic didn't set out to build a hacking tool. They set out to build a better coding assistant.

But the model got so good at reading code and so good at understanding what a programmer intended, as well as spotting the difference between the two, that it could find the flaws that human experts have been missing for decades. So Anthropic trained Claude Mythos to be really good at code, but as a side effect, it got really good at securing code as well. To understand why this is such a huge deal for software stocks, you need to understand how Mythos actually finds these issues. The model is placed in an isolated environment with access to a specific codebase.

It reads through the source files, which is millions of lines of code, and finds the parts most likely to be hiding serious bugs then it writes and runs test programs against that code to confirm or disprove each potential bug when it finds one it writes a formal vulnerability report with a small example that recreates the flaw in practice.

That's exactly what a professional security researcher does today the difference is speed and scale a human analyst might take weeks to audit a single block of code especially if it's mission critical mythos processes an entire code base in hours and it doesn't just find bugs it understands them.

It reads the code the way an engineer reads a blueprint understanding intent spotting where the code doesn't match that intent and reasoning about what would trigger the failure what's even crazier is just how fast this happened Cybergym is a UC Berkeley benchmark that throws over 1500 real-world software bugs from almost 200 open-source projects at different AI models.

The current Claude model, Opus 4.6, scored a 66%. Claude Mythos scored an 83. That's a 16-point leap in one model generation. The difference between a D and a B on a test. That's the jump from occasionally finding bugs to finding bugs in every major operating system and web browser on earth that's what makes this model so dangerous but it didn't stop there it found a 27 year old bug in openbsd which is an operating system that prides itself on being almost impossible to hack this one matters to investors for two reasons first we talk a lot about ai networking but not the code that makes it possible and second this wasn't a single bug it was two bugs that chained together the first was a missing safety check and the second was a a number rolling back to zero at the wrong time.

When combined, they could purposely crash a machine from anywhere on the internet with no authentication required. Governments have trusted this system to run their firewalls since 1998 Mythos found this bug in 2026 It also found flaws in FreeBSD which is how Firefox runs JavaScript It found over 180 different bugs in everything from cryptography libraries to virtual machine monitors and turned them all into functional attacks. Previous models found just two of these bugs. And on Linux, which runs most of the world's servers, Android phones, and cloud infrastructure, it chained four separate vulnerabilities together.

On their own, each bug looked pretty insignificant but combined they let an attacker jump from an ordinary user account to full control of the linux machine mythos is not a proof of concept mythos is a weapon and that's why it scared the market.

But there's something else on the market that you need to know about and that's your private data there are hundreds of online data brokers making big money by collecting and selling your personal information.

They give you a quarterly privacy report showing everything they've done and they reviewed over 55,000 listings for me so far but what really surprised me is these data brokers had way more than just my private data they had my wife's and my entire family's too.

That's another reason I really like Delete Me they have a family plan so we can all have more control over our personal data so if you care about your data and your family's privacy you can get 20% off any consumer plan with my code symbol 20 by going to join delete me dot com slash symbol 20 or with my link in the description.

And a big thank you to our readers for supporting TickerSymbol: YOU. The AI arms race is moving fast.

In 2024, Google's project BigSleep found a single new vulnerability in SQLite. In 2025, a DARPA competition threw 54 million lines of code at competing systems that collectively found 18 bugs. In April of 2026, Mythos found thousands across every major operating system, every major browser, and every major code library on the planet. And it didn't just find bugs, It built working attacks around them. Anthropic says that over 99% of these bugs are still unpatched, because the fixes just haven't been deployed yet, and that should have the market's full attention. And it did, but probably not the way Anthropic wanted. Two weeks before they were ready to announce Mythos, a blog misconfiguration leaked it to the public, and the market was very quick to react. Cybersecurity stocks tanked.

CrowdStrike, Palo Alto Networks, everyone. one. The logic was obvious. If an AI model can find bugs, exploits and vulnerabilities faster than any human, then why do we need a quarter trillion dollar cybersecurity industry in the first place? The market didn't see Mythos as a competitive threat. It saw it as a meteor. And expensive cybersecurity consultants were the dinosaurs. And for a few days, it looked like the market was right. The question was which company would use these capabilities first. And that's where the next phase of this AI arms race begins. Alex Stamos is the former chief security officer at Facebook and Yahoo. Today, he's the chief product officer at Corridor, an AI security startup. Alex put a number to the timeline. Six months.

That's how long before small, open-source models can find bugs as well as mythos. And once that happens, every cybercrime syndicate, every state-sponsored spy, and every individual hacker on the planet gets access to AI-powered exploit discovery. And here's the uncomfortable truth for this entire industry. The bottleneck was never finding the exploits. It was never about bug discovery. Arctic Wolf's threat report found that 76% of actual compromises, the real breaches, the real data being stolen, the real ransomware being deployed, involved one or more of just 10 known already patchable vulnerabilities. The flaws were already found. The patches already existed. Organizations just could not move fast enough to deploy them.

AI just removed the speed limit, not for cybersecurity companies, but for the attackers. When every bad actor on the planet can find bugs at AI speeds, the gap between this bug exists and this bug was exploited collapses from months to hours. The entire defensive model of the cybersecurity industry, find it, report it, patch it, and deploy it, assumes humans are the bottleneck on both sides of the equation. That assumption just broke, since attackers can sit at home and point AI models at public software, pretty much as fast as they can type, while defenders have to fix the code, test it, get approvals, schedule maintenance windows, and avoid breaking their customer deployments. That means tickets, meetings, and manual reviews.

On top of that, attackers benefit from automation, scanning for weaknesses, writing phishing emails, exploring attack pads and generating exploit code while defenders have to slow down to make sure they meet regulatory requirements work with legacy systems check with multiple vendors and have compliances that they need to uphold You can just let an AI patch a problem at a bank or a hospital and hope for the best but you definitely can attack them that way. And that six-month window is actually shrinking. Aisle, an independent security research lab, tested eight smaller, cheaper, publicly available models to see if they could reproduce Mythos' findings. All eight models found the same exploits that Mythos did.

One of those models had 3.6 billion parameters and cost 11 cents per million tokens. For investors, that means it's not about the model itself. It's about the systems built around it. The targeting, the validation, the triage, the relationships with maintainers, but the raw capability is spreading fast.

In fact, Palo Alto Networks' chief security intelligence officer said open models are only weeks or months away from matching mythos cyber security trainers at the sans institute say that that capability exists now for finding and exploiting basic vulnerabilities so six months is the optimistic estimate and the clock started on april 7th.

Now let me say the quiet part out loud the ai model finding bugs to patch is the same ai model that's exploiting them there's no architectural difference there's no switch you flip from offense to defense it's the exact same capability that makes mythos a shield that also makes it a sword.

Anthropic's own red team said it best the same improvements that make the model substantially more effective at patching vulnerabilities also make it substantially more effective at exploiting them before going public with mythos anthropic briefed senior officials at two agencies responsible for defending America's digital infrastructure.

NSA analysts were already discussing what Mythos means for cyber operations. And as an investor, think about what this means for the market. Anthropic, a private company valued at $380 billion after the second largest venture capital raise in history, is sitting on software exploits for almost every major company on Earth.

Over 99% of the vulnerabilities that mythos found are still unpatched, which means anthropic is effectively deciding what gets fixed first, how much information to release, when, and to who.

This is not a product launch, it's a national security threat, and the real question is who ultimately controls this capability, who gets access besides anthropic, and what happens when open models start finding these same exploits all over the internet.

Those aren't questions you're going to get answers to on an earnings call, and this is where anthropic made a big decision that affects the entire stock market.

They didn't sell mythos to the government, they didn't license it to the highest bidder, and they didn't open source it to level the playing field.

They formed a defensive coalition called project glasswing and gave early access to some of the most powerful publicly traded companies on the planet, including amazon, apple, broadcom, cisco, crowdstrike, google, jpmorgan chase, microsoft, nvidia, palo alto networks, and more than 40 other organizations.

The cyber security stocks that went down on the leak surged on the announcement, crowdstrike jumped over six percent in a single session, palo alto rose almost five percent.

The mythos model went from being a sword pointed at the industry to the shield protecting it, and now that you understand what just happened, here's exactly how I'm investing in it.

The biggest thing for investors to understand is that the cybersecurity industry is about to undergo a massive shift, from detecting and responding to threats to predicting and preventing them. The cybersecurity industry spent the last two decades building tools to catch attackers after they got in. Glasswing is the first serious attempt to find every flaw before the attackers do, and the cybersecurity companies inside this coalition are not being disrupted by Mythos. They're being armed with it. If it works, this will be the single biggest shift in cybersecurity since the invention of the firewall. And if it doesn't, every enterprise on Earth just entered an arms race, they have no way to win. But let's talk about who wins from this today.

The obvious winners are the companies inside Project Glasswing, the ones with direct access to Mythos and the infrastructure to deploy what it defines. CrowdStrike focuses on endpoint detection and response, so securing desktops, laptops, and smartphones. Really, any device that connects to a company network. Their Falcon platform has three parts. A suite of cloud-based modules that do things like run virus scans, manage firewalls, and detect malware. They have a separate threat graph that maps out a company's networks, the devices on it, the users, and the permissions to make sure all the network traffic is legit. And then their Falcon Agent is a lightweight agent that runs on each device to send security data back for analysis.

Charlotte AI is their AI assistant layer, and Agentworks is their agentic automation platform.

Being armed with Mythos means that CrowdStrike can use their Falcon platform to proactively patch vulnerabilities across their entire customer base before attackers find them.

CrowdStrike revenue came in at 1 billion dollars for their latest quarter, which is up 23 year over year, annual recurring revenue came in at 5.25 billion dollars, which is up 24, net new arr came in at 331 million dollars, up 47.

And if you think you missed the boat on CrowdStrike, they just posted their first ever gap profitable quarter and their gross customer retention sits at 97 percent.

Crowd Strike stock is not cheap, a hundred billion dollar market cap means roughly 20 times price to sales, but now that they're armed with Mythos, we could see their revenues, their profits, and their overall growth continue to accelerate while their competition still waits for access.

Palo Alto Networks is the other pure play cyber security company in project Glasswing, their strategy is convincing enterprises to consolidate their security spending onto a single platform, network security, cloud security, access protection, and so on.

Cortex, their ai-powered security operations platform, integrates directly with Mythos for proactive threat detection and response.

Palo Alto's annual recurring revenue from next generation security grew by 33 year over year, and their guidance implies more than 50 growth in next-gen security for the rest of this fiscal year.

Their total annual revenue is approaching 11 billion dollars, which makes Palo Alto Networks the cheaper stock, they trade at roughly 14 times sales compared to CrowdStrike's 20, mostly because CrowdStrike is growing significantly faster.

The hyperscalers, Microsoft, Google, and Amazon, form the platform layer of Anthropics project Glasswing, They host Mythos, they use it internally, and they'll probably add it to their server-side security offerings over time.

Microsoft alone runs the largest cloud security business on the planet, bringing in roughly $28.5 billion a year. These companies aren't using Mythos to sell more cloud access. They're using it to manage risk, across the entire infrastructure powering AI and the internet the best way to find great investments is understanding a company's products not just their profits and the best companies have perfect products for quickly growing markets nvidia broadcom apple these companies armed with mythos will define the next era of digital security while everyone else is effectively defending against tomorrow's attacks with yesterday's tools and ai is already making the global cybersecurity market grow fast, from $380 billion in 2026 to $1.2 trillion in 2034.

If that report shows 10-20% of the bugs have been fixed, then the defenders really do have an edge. But if it only shows 1% of the bugs have been fixed, and the vulnerabilities have been closed, then the critics will be right. Attackers will move as fast as AI, while defenders will stay at the speed of tickets, the speed of meetings, and manual reviews. Remember, finding bugs can be automated, but fixing them can't, especially for banks, for hospitals, and for other regulated industries. That's why I think Palantir will play an important role here too. But there's one last conflict that I'm not sure how Anthropic will overcome, or if they even can. Anthropic is reportedly considering an IPO in October of 2026.

That means that the company that decided Mythos was too dangerous to sell will also need to justify a half trillion dollar valuation to public market investors. The conflict between cyber safety and shareholders is very real. Anthropics' 90-day security report will land in July. Open models are improving every single month. The clock is ticking. But whether Anthropics bet that six months of Mythos running defense can outpace AI-powered offense will pay off for the companies in Project Glasswing, for their stocks, and for the security of every data center on the planet, it, that's something the market hasn't priced in yet. Let me know what you think in the comments.

Is Mythos a temporary edge for the defenders? Or is this AI-driven arms race the start of a new era of cyber security? And if you want to see more science behind the stocks, check out this video next. Either way, thanks for watching and until next time, this is Ticker Symbol U. My name is Alex, reminding you that the best investment you can make is in you.

Key Takeaways

Claude Mythos, a general-purpose language model, has found serious security flaws in every major operating system and web browser, including a 27-year-old bug in OpenBSD.

Mythos is not just a proof of concept, but a powerful tool that can be used for both offense and defense, with the potential to disrupt the cybersecurity industry.

Anthropic, the company behind Mythos, has formed a defensive coalition called Project Glasswing to give early access to some of the most powerful publicly traded companies on the planet.

The cybersecurity industry is expected to undergo a significant shift from detecting and responding to threats to predicting and preventing them, with companies like CrowdStrike and Palo Alto Networks well-positioned to benefit.

The global cybersecurity market is expected to grow from $380 billion in 2026 to $1.2 trillion in 2034, with a compound annual growth rate of 15.5%.