Should South African organisations be panicked about Claude Mythos? The answer depends partly on whether the model lives up to its own marketing hype and partly on a set of defensive questions that are going to matter regardless.
A brief recap: Mythos is the most capable AI model that San Francisco-based Anthropic has built, sitting above the Opus tier, its current flagship. The new model’s existence was revealed in late March when a configuration error in Anthropic’s content management system exposed roughly 3 000 unpublished assets, including a draft blog post describing a model Anthropic said posed “unprecedented cybersecurity risks”.
The company confirmed the leak, officially announced Claude Mythos Preview on 7 April, and said it would not be releasing the model publicly. Access is being granted via a restricted programme called Project Glasswing to a small group of early-access customers, with a version now being rolled out to US federal agencies.
Anthropic’s own documents show Mythos developing and using a full Linux kernel exploit – the kind of offensive work that used to require senior security talent operating over weeks.
This is an unusual sequence of events. It is also one that has done more for Anthropic’s enterprise positioning than any advertising campaign could have. TechCentral readers are entitled to some scepticism here: the shape of the story – a capability so dangerous it must be restricted, but not so dangerous that it cannot be sold to useful customers – sounds suspiciously like a marketing stunt. A system misconfiguration that happens to expose exactly the sort of draft blog a marketing team would have published anyway? Read into that what you will.
Direction of travel
But that scepticism does not make the underlying trend any less real. Even discounting Anthropic’s own framing, the direction of travel in frontier AI is unambiguous. Whether or not this specific model lives up to the hype, the broader shift is that vulnerability discovery is becoming cheap. And the economics of attack are changing faster than the economics of defence. That’s the real problem – not Mythos, and not any single model.
Armand Kruger, head of cybersecurity at NEC XON, noted in recent comments to TechCentral that the challenge for chief information security officers (CISOs) is no longer finding vulnerabilities but prioritising and remediating them fast enough. The time to vulnerability discovery is being compressed with each advancing AI model.
Read: Anthropic’s Mythos is the cyberthreat every CISO feared
And let’s not sugarcoat this: South Africa is behind. Patching cycles in many organisations still run into weeks. Architecture-led security – systems designed to limit blast radius and enforce least privilege so that inevitable flaws do less damage – remains concentrated in the top tier of the banks and other financial services players.
The public sector is dangerously far behind: the recent run of government compromises did not require a frontier AI model to pull off. Mid-market enterprises and state-owned entities have neither the tools nor the architectural maturity to absorb a continuous-discovery threat model.
Popia enforcement is tightening, but the regulatory framework assumes a breach-response posture that predates AI-accelerated discovery. The Information Regulator was already stretched before any of this.
The department of communications & digital technologies’ draft AI policy framework, published last week, focuses on ethics and bias, and less on cyber resilience. Meanwhile, the Cybersecurity Hub at the department has never operated at serious scale.
If Mythos is even half as capable as Anthropic suggests, and if the broader trend continues at half its current pace, attacker-side economics will shift enough in the coming months that we should all be deeply concerned.
The defensive questions – namely, do you have continuous monitoring, time-bound privileged access and patching discipline at automated pace – apply regardless of whether the specific model doing the attacking is called Mythos or something released by a competitor six months from now.
The instinct with frontier AI has been to focus on areas such as job displacement, economic disruption and model bias. Mythos, marketing caveats and all, is a reminder that the nearer-term enterprise impact will be in cybersecurity – whether patching cycles, identity governance and security architectures can cope with an adversary that has the equivalent of a tireless senior offensive researcher available on demand.
Read: South Africa ‘isn’t ready’ for AI-accelerated cyberattacks
This is not a 2028 problem; it’s here now, in 2026. And South African organisations that still treat security as a periodic audit function are simply not ready for it. — (c) 2026 NewsCentral Media
Get breaking news from TechCentral on WhatsApp. Sign up here.