Thursday, 09 April 2026 / Published in Artificial Intelligence, Cybersecurity, Development, Emerging Threats, Threat Intelligence

Anthropic’s Claude Mythos Achieves Autonomous Zero-Day Exploitation, While Iranian APTs Target US Critical Infrastructure

Anthropic's Claude Mythos Achieves Autonomous Zero-Day Exploitation, While Iranian APTs Target US Critical Infrastructure

This week, the cybersecurity landscape witnessed a significant shift with Anthropic's Claude Mythos demonstrating autonomous zero-day exploitation, signaling a new era in vulnerability research and defense. Concurrently, Iranian APT actors escalated their activities, targeting US critical infrastructure through PLC exploitation and accelerating Medusa ransomware attacks. These developments underscore the growing sophistication of both offensive and defensive AI capabilities, alongside persistent nation-state threats to essential services.

Anthropic's Claude Mythos Preview Demonstrates Autonomous Zero-Day Exploitation, Reshaping Cybersecurity Landscape

Anthropic has unveiled Claude Mythos Preview, an AI model capable of autonomously discovering and exploiting zero-day vulnerabilities in production software. This development marks a significant shift in the cybersecurity landscape, as the model has reportedly identified thousands of previously unknown flaws across major operating systems and browsers, including a 17-year-old remote code execution vulnerability in FreeBSD and a 27-year-old bug in OpenBSD. The ability of Mythos Preview to move from vulnerability analysis to exploitation without human guidance represents a new era in offensive security capabilities, democratizing advanced hacking techniques.

The implications of Mythos Preview's capabilities are profound for both offensive and defensive security. While the model is not publicly available, Anthropic has launched "Project Glasswing," a defensive coalition with major tech companies like Amazon, Apple, Microsoft, and Google, to proactively patch critical software. This initiative aims to leverage the AI's advanced vulnerability detection to strengthen global infrastructure before similar autonomous exploitation capabilities become more widespread. The rapid pace of AI-driven vulnerability discovery is already outstripping the capacity for human-led remediation, as evidenced by HackerOne's decision to pause new submissions to its Internet Bug Bounty program due to an overwhelming volume of AI-assisted bug findings.

The economic barrier to entry for offensive cyber operations is also being fundamentally recalibrated. Historically, discovering and exploiting zero-day vulnerabilities required extensive labor from highly skilled security researchers. Mythos Preview has demonstrated the ability to perform this entire process for under $50 in compute costs in some instances, making sophisticated attacks more accessible. This necessitates a fundamental re-evaluation of security strategies, emphasizing the need for AI-native application security tooling and significantly accelerated patch timelines to counter the growing attack surface.

C3 AI Launches Agentic Platform for Autonomous Enterprise Application Development

C3.ai Inc. has unveiled C3 Code, a new agentic software development platform designed to autonomously transform natural language prompts into production-ready enterprise applications. This platform aims to significantly reduce software development timelines from months to mere hours by automating the entire application development lifecycle, including initial design, data modeling, testing, and deployment. C3 AI states that this innovation addresses the "last mile" challenge in generative AI code, moving beyond simple code snippets to full-fledged enterprise solutions.

The C3 Code platform operates as an orchestrator for multiple AI agents, allowing developers to describe business problems in plain English rather than manually integrating databases and APIs. This approach is intended to make AI-generated enterprise applications more accessible to business users. C3 AI emphasizes that the platform is "open by design," enabling customers to utilize various large language models while maintaining application and data portability.

This development is significant for enterprise AI adoption, as it promises to streamline the creation of complex applications that traditionally require extensive data science and development teams. By automating these processes, C3 Code could accelerate the deployment of AI solutions for critical business functions like predictive maintenance and supply chain logistics, areas where existing low-code/no-code tools often fall short.

Iranian APT Actors Exploit PLCs in US Critical Infrastructure, Storm-1175 Accelerates Medusa Ransomware Attacks

The U.S. government has issued a stark warning regarding Iranian-linked Advanced Persistent Threat (APT) groups actively exploiting internet-facing Operational Technology (OT) devices, specifically Programmable Logic Controllers (PLCs) from Rockwell Automation/Allen-Bradley. These attacks, which began last month, are targeting critical infrastructure sectors including energy, water and wastewater, and government facilities, causing operational disruption and financial losses. The joint advisory from the FBI, CISA, NSA, EPA, DOE, and CNMF highlights the urgent need for organizations to remove PLCs from direct internet exposure and implement secure gateways and firewalls.

In a separate but equally concerning development, the China-linked cybercriminal group Storm-1175 is deploying Medusa ransomware with unprecedented speed, often completing attacks within a 24-hour cycle. This group leverages zero-day and N-day exploits, significantly reducing the window for detection and response that traditional security measures rely upon. Storm-1175's rapid deployment timeline, which is considerably faster than the average ransomware dwell time, poses a severe challenge for organizations, particularly those in manufacturing, healthcare, and financial services with legacy web applications and exposed administrative interfaces.

These incidents underscore a critical shift in the threat landscape, where state-sponsored actors and sophisticated cybercriminal groups are increasingly utilizing advanced tactics and zero-day vulnerabilities to target essential services and critical infrastructure. The industrialization of AI deception, as highlighted in iProov's 2026 Threat Intelligence Report, further exacerbates these threats, with a significant surge in iOS-targeted injection attacks and deepfake impersonation within enterprises. The convergence of these threats necessitates a proactive and adaptive cybersecurity posture, emphasizing real-time threat intelligence and robust defensive measures to safeguard against evolving attack methodologies.

Anthropic Launches Project Glasswing for AI-Driven Vulnerability Detection

Anthropic has unveiled "Project Glasswing," a significant new initiative focused on applying advanced AI, specifically its powerful Claude Mythos Preview model, to defensive cybersecurity. The project aims to autonomously identify and remediate previously undiscovered vulnerabilities in critical software systems. This marks a strategic shift towards leveraging AI for high-stakes, critical infrastructure protection, moving beyond general productivity applications. The Claude Mythos Preview model, described as Anthropic's most capable for coding and autonomous tasks, is not publicly available due to its advanced capabilities, which include demonstrating the ability to "break out" of its test environment.

Project Glasswing's early testing with industry partners has already yielded substantial results, uncovering thousands of previously unknown "zero-day" vulnerabilities that had evaded detection for years. Notable discoveries include a 27-year-old weakness in the OpenBSD operating system and a 16-year-old flaw in the widely used FFmpeg video processing software. The AI system also demonstrated the ability to chain multiple smaller vulnerabilities within the Linux kernel to achieve full system control, an advanced attack technique. Anthropic has responsibly disclosed and patched all identified vulnerabilities.

To accelerate the adoption and impact of this technology, Anthropic has pledged up to $100 million in usage credits to over 40 organizations responsible for maintaining critical digital infrastructure. These organizations will utilize Project Glasswing to scan both proprietary and open-source software for security risks. Additionally, $4 million will be donated to open-source security organizations to support patch development and vulnerability remediation efforts. This initiative underscores a growing industry focus on safe, controlled, and trustworthy AI systems for critical domains like cybersecurity, where accuracy and reliability are paramount.

Iranian Hackers Target U.S. Critical Infrastructure with PLC Exploitation

A new advisory from the Cybersecurity and Infrastructure Security Agency (CISA), FBI, and National Security Agency (NSA) warns that Iranian-affiliated hackers are actively exploiting cyber vulnerabilities in key software systems at U.S. water and energy providers. Specifically, programmable logic controllers (PLCs) developed by Rockwell Automation/Allen-Bradley are being targeted, with potential threats to PLCs from other manufacturers. This escalation in Iranian cyber activity is likely a response to ongoing geopolitical tensions and highlights a significant risk to operational technology (OT) environments.

The attacks involve disrupting PLCs through malicious interactions with software and configuration settings, as well as manipulating data on human-machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. This can lead to operational disruptions and financial losses. The advisory notes that Iranian-affiliated advanced persistent threat (APT) campaigns against U.S. organizations have recently escalated, moving faster and broader to target both IT and OT infrastructure.

In late 2023, the Iranian threat group Cyber Av3ngers (also known as Hydro Kitten, Shahid Kaveh Group, and UNC5691) was linked to the exploitation of Unitronics PLCs, impacting at least 75 devices, including the Municipal Water Authority of Aliquippa in western Pennsylvania. The current advisory confirms a continued and intensified focus on critical infrastructure, urging organizations to update security precautions for these vital industrial control systems.

Sources

You must be logged in to post a comment.