Anthropic study shows AI needs hours, not weeks, to build exploits from security patches

Anthropic’s security team found that its Mythos Preview AI model can turn security patches for Firefox and the Windows kernel into working exploits within hours, for a few thousand dollars and no specialized knowledge. Eight complete attack chains were finished before Microsoft’s auto-updates had reached a single device.

When software makers close security holes, a race starts. Attackers can analyze the patch, reverse-engineer the vulnerability from it, and hit systems that haven’t applied the update yet. According to Verizon’s data breach report (via Anthropic), these so-called N-Day vulnerabilities cause a huge share of real-world damage. Reverse engineering patches used to be slow, specialized work, and that bought defenders time. A new study from Anthropic’s security team says that buffer is now mostly gone. “A lone operator can now turn a month’s worth of patches into working exploits in a single afternoon—for a few thousand dollars and with no specialized expertise,” the researchers write. A security patch implicitly tells you where the bug was. Attackers compare old code with new code and pinpoint the flaw. Historically, this took weeks. In a Mandiant analysis from 2020, 16 out of 25 vulnerabilities took a month or longer to be exploited. Anthropic measured how much large language models speed this up. Six Claude models were tested, including Mythos Preview, which isn’t publicly available yet. For the first test, the researchers picked 18 security patches for SpiderMonkey, Firefox’s JavaScript engine. Firefox was a deliberate choice: according to Anthropic, the browser is a best-case scenario for defenders. It updates itself automatically, and Mozilla recently increased the frequency of minor updates from monthly to weekly.