FBI sees Anthropic’s Mythos as a law enforcement challenge

Summary

An FBI official has voiced concerns that advanced AI models like Anthropic's Mythos could pose significant challenges for law enforcement due to their ability to identify and exploit unknown software vulnerabilities. While export controls were initially imposed on Mythos 5, they were later lifted after Anthropic implemented new safeguards. The FBI anticipates that adversaries will eventually leverage such AI capabilities at scale, complicating investigations and increasing the potential for cyberattacks.

Full text

Advancements in AI model capabilities, like those found in Anthropic’s Mythos, are raising concerns from law enforcement agencies about what adversaries may be capable of with the emerging technologies, an FBI official said Tuesday. The Trump administration imposed export controls on the Mythos 5 model in June shortly after its release, citing national security implications. In a blog previewing the model’s capabilities, Anthropic said Mythos 5 could identify and exploit bugs that were not previously known “in every major operating system.” Over the past several weeks, the prohibitions were lifted after the model maker worked with the government and other partners to review guardrails. While new safeguards were added, wariness stemming from the increase in capabilities are still present. “Mythos found vulnerabilities in some of the open-source code that is so ubiquitous — it’s in the vast majority of our most foundational code for things like operating systems, security, web infrastructure, encryption,” Todd Hemmen, deputy assistant director at the FBI, said during a Digital Government Institute event. “It presents future challenges for law enforcement.” The FBI is the lead federal agency for investigating cyberattacks and intrusions, putting it at the forefront of a landscape in flux. “Seeing the potential for exposing vulnerabilities … and understanding that the future holds potential for an increase in those types of cases and exploitations from our adversaries is newer,” Hemmen said. “Though we haven’t seen this operationalized at scale, the expectation is that there is a future date where that is coming.” When anyone can access tools with wide-ranging security implications, the suspect list grows longer and investigations become more complex. While Mythos 5 is only available to a select U.S. government-approved group, an Anthropic-built model with the same underlying technology is available globally. The AI vendor also found that “less capable” models could identify vulnerabilities and exploit them in the same way. “AI is going to present significant challenges for us moving forward,” Hemmen said. Internal AI use As AI advancements are changing the law enforcement landscape for the FBI, the technology is also altering how the Department of Justice unit operates internally. “As an enterprise, we are leveraging AI for facial recognition technology,” Hemmen said. In the agency’s latest AI use case inventory that was published earlier this year, the FBI identified a handful of new projects aimed at generating investigative leads using facial matches and other data. The use cases are characterized as high-impact, meaning they could serve as a principal basis for decisions or actions that have a legal, material, binding or significant effect on rights or safety. Despite an April 3 deadline outlined by the Office of Management and Budget, the FBI has not completed its risk management requirements for any of its high-impact use cases, per the inventory. Overall, the DOJ division has around 50 AI use cases. FBI staff are tapping the technology to help sift through public reports of criminal allegations, enhance court-authorized offensive operations and as part of general research, among other use cases. “We’re using AI to help triage those things and with a human in the loop to review everything that’s being done,” Hemmen said. Share Facebook LinkedIn Twitter Copy Link

Indicators of Compromise

• malware — Mythos 5

Entities