Identity Security in the Age of AI-Powered Cyberattacks

Anthropic's Claude Mythos Preview can find and exploit zero-day vulnerabilities across every major OS and browser autonomously. Here is why identity security is now the most critical defensive layer organizations have left.

On April 7, Anthropic's red team published a technical assessment of Claude Mythos Preview, a new model whose cybersecurity capabilities represent a generational leap. The findings are astonishing: Mythos Preview autonomously discovered and exploited zero-day vulnerabilities in every major operating system, every major web browser, and widely-deployed cryptography libraries often chaining together multiple bugs into full exploit chains that expert penetration testers said would have taken them weeks to develop manually.

For organizations that depend on identity as a security layer, which is all of them, the implications are significant. When an AI agent can independently bypass authentication protocols, forge certificates, and escalate privileges from unauthenticated outsider to root-level access, the traditional perimeter-based security model isn't just inadequate, it is effectively dissolved.

What Mythos Preview Actually Did

The Anthropic red team ran Mythos Preview through an agentic scaffold: a containerized environment with source code and a one-paragraph prompt essentially saying "find a security vulnerability." No human guidance after that. The model read code, formed hypotheses, tested them, used debuggers, and produced working exploits.

1000+ critical-severity vulnerabilities disclosed

181 working FireFox exploits

27 year-old bug found in OpenBSD

CRITICAL FINDINGS:

Mythos Preview identified authentication bypass vulnerabilities in major cryptography librariesincluding weaknesses in TLS, AES-GCM, and SSH implementations — that allow attackers to forge certificates or decrypt encrypted communications. One critical vulnerability enabling certificate authentication bypass has already been publicly disclosed.

Why Identity Is Now the Central Battleground

When AI models can autonomously discover and exploit buffer overflows, race conditions, and logic bugs at this scale, the traditional layered defence model gets compressed. Firewalls, network segmentation, and endpoint detection remain important, but they become speed bumps rather than barriers. The one layer that matters most, and the one that determines who gets access to what is identity.

Authentication bypasses are no longer hypothetical

Among the most alarming findings were multiple complete authentication bypasses in web applications that allowed unauthenticated users to grant themselves administrator privileges, and account login bypasses that circumvented both passwords and two-factor authentication codes. Please note that these were not fabricated lab scenarios, they were real vulnerabilities in production software, found autonomously by an AI model.

For any organization still relying on passwords as a primary authentication factor, this should be treated as an critical threat signal. Password-based authentication has always been the weakest link; now there's an AI that can find the specific implementation flaw that lets an attacker skip it entirely.

Privilege escalation is now an automated pipeline

One of the most detailed findings in the Anthropic assessment was Mythos Preview's ability to chain multiple vulnerabilities together to achieve full privilege escalation on the Linux kernel. In nearly a dozen documented cases, the model independently identified and combined two, three, and sometimes four separate vulnerabilities to go from an unprivileged local user to complete root access.

The pattern is consistent and alarming: the model uses one vulnerability to bypass kernel address space layout randomization (KASLR), another to read the contents of a protected data structure, a third to write to a previously freed memory object, and then chains this with a heap spray to place a crafted struct exactly where the write will land. The end result is that an unprivileged user gains full administrative control of the system.

For identity security, this matters because privilege escalation is the step that turns a compromised credential into a full breach. An attacker who gains access through a stolen password or a session token is typically limited by the permissions assigned to that account. Privilege escalation removes that constraint entirely. When AI can automate this process, the gap between "initial access" and "total compromise" shrinks from days or weeks to hours, and the value of strong identity controls at every layer of the stack, not just the front door, becomes impossible to ignore.

Credential and privileged attacks will scale exponentially

The Mythos Preview findings demonstrate that non-experts can now leverage AI models to find sophisticated vulnerabilities. Anthropic noted that engineers with no formal security training asked Mythos Preview to find remote code execution vulnerabilities overnight and woke up to complete working exploits.

With sophisticated exploit development no longer limited to elite researchers, credential theft, session hijacking, authentication bypass, and privileged access abuse will scale dramatically. An attacker who gains initial access through a compromised credential can now use AI-assisted tools to rapidly discover privilege escalation paths, turning a single stolen login into unrestricted administrative control. The attack surface for identity-based attacks is about to expand in ways the industry has not fully grasped.

What This Means for Your Identity Security Strategy

Anthropic's own recommendations focus on shortening patch cycles, automating incident response, and using current AI models defensively. These are sound. But for identity security specifically, several actions are urgent.

Eliminate passwords wherever possible

When AI can find authentication bypass vulnerabilities that have been hiding in code for decades, the complexity of your password policy is irrelevant. The vulnerability isn't the user choosing a complex password it is the authentication implementation itself. Passwordless authentication removes an entire category of attack surface. Cryptographic, device-bound credentials, with are fundamentally harder for exploit chains to circumvent because there is no shared secret to intercept or bypass.

Implement privileged access management with zero standing privileges

Mythos Preview demonstrated that privilege escalation from a standard user to full root access can now be automated end to end. In that environment, standing privileges become a liability. Every account with persistent administrative rights is a target that an AI-assisted attacker can find and exploit. Organizations should adopt a zero standing privileges model, where elevated access is granted only when needed, scoped to a specific task, and automatically revoked when that task is complete. Privileged access management platforms that enforce just-in-time ephemeral elevation, session monitoring, and approval workflows significantly reduce the window an attacker has to escalate and move laterally, even after an initial compromise.

Decentralize your identity architecture

Centralized identity providers become high-value targets when exploit development is cheap. A single vulnerability in a centralized IdP can compromise every application it protects. Decentralized identity architectures where cryptographic proofs are verified at the edge without a single point of failure reduce the blast radius of any individual exploit.

Prepare for non-human identity threats

The Mythos Preview article focuses on software vulnerabilities, but the same AI capabilities that find bugs in C/C++ language code will find logic flaws in API authentication, service-to-service trust relationships, and agent-to-agent authorization. As organizations deploy AI agents and automated workflows, non-human identity (NHI) management becomes a critical attack surface. Every service account, API key, and machine credential is a potential entry point for an AI-augmented attacker.

Is Your Identity Infrastructure Ready?

Anthropic's red team made one observation that should stay with every identity security leader: mitigations built on friction rather than hard barriers will weaken significantly against AI-assisted adversaries.

Passwords are friction. Complex login flows are friction. Security questions are friction. Standing privileged access is friction. The capabilities demonstrated by Mythos Preview, which include autonomous discovery of decades-old bugs, multi-vulnerability exploit chains, and automated privilege escalation from standard user to root, were previously exclusive to nation-state teams and elite researchers. That exclusivity is ending.

Anthropic has chosen not to release Mythos Preview publicly, but they have been transparent that similar capabilities will emerge from other model developers. The defensive window is open. It will not stay open indefinitely.

If an AI can escalate privileges and bypass authentication faster than your team can respond, what is your identity infrastructure actually protecting?