Strategy - July 3, 2026 - 8 min read
Hacking Your Business Now Costs $50: What Claude Fable 5 Is and How It Defends You (This Week)
An AI that finds and exploits security flaws almost on its own is here. It sounds like lab stuff, but it lands straight on your website, your CRM, and your customer data. Here's what actually changed - the threat, the opportunity, and the 5 moves to lock down this week.
Todd & Naty Ross - Co-founders, Hub365
Last month a client messaged us, scared by a headline: "an AI can now hack any system on its own." He wanted to know if he had to shut everything down. We told him what we'll tell you: don't shut anything down, but don't ignore it either. Because the headline is real - and it's only half the story.
The other half - the part almost nobody tells you - is that this same power now costs ten dollars and is on your side if you know how to use it. Let's get practical.
icon: 🔑 type: key title: The hard truth body: The AI that can break systems is here. The AI that can lock them down is too. Two sides of the same coin. It no longer matters whether your business is big or small - it matters whether you're easy or hard. That part, you decide.
<!-- /widget:callout -->01 - What happened, in plain English
In April 2026, Anthropic (the company behind Claude) unveiled Mythos, an AI that can find security flaws in software and build the attack to exploit them, practically on its own. It found a 27-year-old hole in one of the most secure systems in the world. And it wasn't a fluke: the companies that tested it found over 10,000 serious flaws in weeks.
Google had already done the same on the good side: its "Big Sleep" AI stopped a real attack before it happened. And another AI, XBOW, reached the #1 spot on the US ethical-hacker leaderboard, above thousands of humans.
icon: ℹ️ type: info title: The stat that changes everything body: One of those AI attacks cost under $50. When attacking gets that cheap and automatic, the attacker no longer picks victims by size or by how juicy the loot is. They pick by how easy it is to get in.
<!-- /widget:callout -->02 - The two sides that affect you
title: Two sides of the same coin
- The risk side: attacks got cheap. You used to be "too small to bother with." That's over. An AI attacker looks for easy: a website with flaws nobody reviewed, an email address that can be spoofed, reused passwords with no two-factor, customer data stored unprotected.
- The opportunity side: defense got democratized. That same power now costs $10 per million words in the public version (Fable 5). Enterprise-grade security that only banks used to afford is now within reach of a 5-to-50-person business. Whoever moves first turns the threat into a sales argument: "we work with AI-assisted security" is real trust for customers who verify more every day.
03 - Fable 5 vs Mythos: why this is a business lesson
Here's the most useful detail, and it isn't technical: Mythos and Fable 5 are the same model. Identical power, identical price. The difference? The safety brakes.
- Mythos has no brakes - it's for approved cyberdefense organizations.
- Fable 5 (the public version) has a watchman: when someone asks it something dangerous, the dangerous model doesn't answer; the question is routed to a safer one. It happens in under 5% of cases; the rest of the time it performs identically.
The lesson for you: security wasn't about having "the most powerful AI." It was about the architecture around it - the controls, who can do what. Same in your company. The most expensive tool doesn't save you; the system that decides how it's used does. Same goes for wiring tools into your business - we cover it in Connectors aren't a system.
04 - 5 concrete moves you can make this month
None of this requires you to be technical. It requires you to decide.
title: The 5 plays to lock down
- Close the obvious doors first. Two-factor (2FA) on everything: email, banking, CRM, social. Unique passwords in a manager. This stops the vast majority of automated attacks, and it's free or nearly so.
- Fix your domain and email. A misconfigured domain lets people spoof your email and sends you to spam without you noticing. It's a silent, common failure - we explain the four typical ones in Domain compliance: the 4 silent problems killing your email.
- Review who touches your data. Where does your customer data live? Who has access? What happens when an employee leaves? The "least access possible" principle isn't just for banks.
- Install AI with judgment, not on trend. The same leap that brings superpowers brings risk: wiring AI tools into your systems without control opens new doors. The difference between an AI that just talks and one that does real work - with the permissions that implies - is in The AI that talks vs. the AI that does your work.
- Get on the side that uses AI to defend. Monitoring, reviewing your site and forms, fast incident response: it can be automated today. You don't need a ten-person security team; you need the right system connected.
What the experts say (translated to business language)
Sean Heelan (independent researcher). Proved an AI could find a serious flaw in the heart of Linux. For you: a system's age doesn't make it safe. If it happens to Linux, it can happen to your software.
Nico Waisman (XBOW). His AI reached #1 on the US ethical-hacker board. He argues that AI explores and a human verifies. For you: distrust anyone selling "magic AI with no oversight."
Bruce Schneier (the necessary skeptic). Warns there's a lot of hype: Mythos finds thousands of flaws, but almost none have been fixed. For you: finding the problem isn't solving it. Demand verifiable results, not headlines.
Jack Clark (Anthropic co-founder). His team believes 2026 is the year AI reaches expert level in cybersecurity. For you: this isn't a fad that passes. Preparing now is cheaper than reacting later.
The Big Sleep team (Google). Proved AI can foil an attack before it happens. For you: proactive defense is no longer theory.
A conversation from our kitchen
N - Naty: The client who messaged us scared didn't need to shut anything down. He needed two or three basics done right: two-factor, the domain in order, and knowing who touches his data.
T - Todd: And that's the point. People hear "AI that hacks by itself" and freeze. But 90% of automated attacks come through the door you left open, not a kernel zero-day.
N - Naty: Same thing Anthropic learned with Fable: security wasn't the model, it was the control layer on top. In a business it's the same - it's not the expensive tool, it's the system.
T - Todd: And whoever moves now turns this into an edge. "We work with AI-assisted security" sells. Fear is optional; preparation isn't.
icon: 💡 type: tip title: The two halves of winning body: Closing the obvious doors gets you off the radar of easy attacks. Putting AI on your side - monitoring and response - gives you the edge. Do one without the other and you're still exposed. The win is basic defense plus a connected system.
<!-- /widget:callout -->Frequently Asked Questions
Q: Is my small business really a target? A: Yes. AI attacks got automated and cheap (one cost under $50), so you're no longer chosen by size but by how easy you are to get into. A small business with open doors is more attractive than a well-secured large one.
Q: What is Claude Fable 5 and why should I care? A: It's the public version of Anthropic's most advanced AI model, as capable as the restricted one (Mythos) but with safety brakes. It costs from $10 per million words, which puts enterprise-grade capability within reach of a small business - to defend yourself, not just to be attacked.
Q: What's the first thing I should do today? A: Turn on two-factor (2FA) for your email, banking, CRM, and social accounts, and switch to unique passwords with a manager. It's free or nearly so, and it stops the vast majority of automated attacks.
Q: Do I need to hire a cybersecurity team? A: No. You need three things: close the obvious doors, get order into who accesses what, and work with someone who assembles the whole system (website + CRM + automation + controls) instead of selling you a standalone tool.
Q: Isn't this all just AI-company hype? A: There is hype, which is why we cite skeptics like Bruce Schneier: Mythos found 10,000 flaws but almost none have been patched. The lesson isn't to panic - it's to demand verifiable results and do the basics well.
<!-- /widget:faq -->trigger_en: LOCKDOWN trigger_es: BLINDAJE text_en: Want to know where your business is exposed and what to close first? Comment LOCKDOWN and our automation sends you the security checklist + the 5 moves instantly, free. text_es: Quieres saber donde esta expuesto tu negocio y que cerrar primero? Comenta BLINDAJE y nuestra automatizacion te envia la checklist de seguridad + los 5 movimientos al instante, gratis.
<!-- /cta:whatsapp -->Sources
- Project Glasswing - Anthropic
- Claude Fable 5 and Claude Mythos 5 - Anthropic
- Assessing Claude Mythos Preview's cybersecurity capabilities - Anthropic
- How XBOW Ranked #1 in Autonomous Penetration Testing - XBOW
- Google AI "Big Sleep" Stops Exploitation of Critical SQLite Vulnerability - The Hacker News
- Anthropic's Project Glasswing Update - Schneier on Security
- Anthropic says Trump admin has lifted export controls on Claude Fable 5 and Mythos 5 - CNBC
