Last month a client messaged us, scared by a headline: "an AI can now hack any system on its own." He wanted to know if he had to shut everything down. We told him what we'll tell you: don't shut anything down, but don't ignore it either. Because the headline is real - and it's only half the story.
The other half - the part almost nobody tells you - is that this same power now costs ten dollars and is on your side if you know how to use it. Let's get practical.
01 - What happened, in plain English
In April 2026, Anthropic (the company behind Claude) unveiled Mythos, an AI that can find security flaws in software and build the attack to exploit them, practically on its own. It found a 27-year-old hole in one of the most secure systems in the world. And it wasn't a fluke: the companies that tested it found over 10,000 serious flaws in weeks.
Google had already done the same on the good side: its "Big Sleep" AI stopped a real attack before it happened. And another AI, XBOW, reached the #1 spot on the US ethical-hacker leaderboard, above thousands of humans.
02 - The two sides that affect you
03 - Fable 5 vs Mythos: why this is a business lesson
Here's the most useful detail, and it isn't technical: Mythos and Fable 5 are the same model. Identical power, identical price. The difference? The safety brakes.
- Mythos has no brakes - it's for approved cyberdefense organizations.
- Fable 5 (the public version) has a watchman: when someone asks it something dangerous, the dangerous model doesn't answer; the question is routed to a safer one. It happens in under 5% of cases; the rest of the time it performs identically.
The lesson for you: security wasn't about having "the most powerful AI." It was about the architecture around it - the controls, who can do what. Same in your company. The most expensive tool doesn't save you; the system that decides how it's used does. Same goes for wiring tools into your business - we cover it in Connectors aren't a system.
04 - 5 concrete moves you can make this month
None of this requires you to be technical. It requires you to decide.
What the experts say (translated to business language)
Sean Heelan (independent researcher). Proved an AI could find a serious flaw in the heart of Linux. For you: a system's age doesn't make it safe. If it happens to Linux, it can happen to your software.
Nico Waisman (XBOW). His AI reached #1 on the US ethical-hacker board. He argues that AI explores and a human verifies. For you: distrust anyone selling "magic AI with no oversight."
Bruce Schneier (the necessary skeptic). Warns there's a lot of hype: Mythos finds thousands of flaws, but almost none have been fixed. For you: finding the problem isn't solving it. Demand verifiable results, not headlines.
Jack Clark (Anthropic co-founder). His team believes 2026 is the year AI reaches expert level in cybersecurity. For you: this isn't a fad that passes. Preparing now is cheaper than reacting later.
The Big Sleep team (Google). Proved AI can foil an attack before it happens. For you: proactive defense is no longer theory.
A conversation from our kitchen
Frequently Asked Questions
Q: Is my small business really a target? A: Yes. AI attacks got automated and cheap (one cost under $50), so you're no longer chosen by size but by how easy you are to get into. A small business with open doors is more attractive than a well-secured large one.
Q: What is Claude Fable 5 and why should I care? A: It's the public version of Anthropic's most advanced AI model, as capable as the restricted one (Mythos) but with safety brakes. It costs from $10 per million words, which puts enterprise-grade capability within reach of a small business - to defend yourself, not just to be attacked.
Q: What's the first thing I should do today? A: Turn on two-factor (2FA) for your email, banking, CRM, and social accounts, and switch to unique passwords with a manager. It's free or nearly so, and it stops the vast majority of automated attacks.
Q: Do I need to hire a cybersecurity team? A: No. You need three things: close the obvious doors, get order into who accesses what, and work with someone who assembles the whole system (website + CRM + automation + controls) instead of selling you a standalone tool.
Q: Isn't this all just AI-company hype? A: There is hype, which is why we cite skeptics like Bruce Schneier: Mythos found 10,000 flaws but almost none have been patched. The lesson isn't to panic - it's to demand verifiable results and do the basics well.
trigger_en: LOCKDOWN trigger_es: BLINDAJE text_en: Want to know where your business is exposed and what to close first? Comment LOCKDOWN and our automation sends you the security checklist + the 5 moves instantly, free. text_es: Quieres saber donde esta expuesto tu negocio y que cerrar primero? Comenta BLINDAJE y nuestra automatizacion te envia la checklist de seguridad + los 5 movimientos al instante, gratis.
Sources
- Project Glasswing - Anthropic
- Claude Fable 5 and Claude Mythos 5 - Anthropic
- Assessing Claude Mythos Preview's cybersecurity capabilities - Anthropic
- How XBOW Ranked #1 in Autonomous Penetration Testing - XBOW
- Google AI "Big Sleep" Stops Exploitation of Critical SQLite Vulnerability - The Hacker News
- Anthropic's Project Glasswing Update - Schneier on Security
- Anthropic says Trump admin has lifted export controls on Claude Fable 5 and Mythos 5 - CNBC
