"Dangerous" AI models are coming no matter what

Anthropic recently removed its Claude Fable 5 and Mythos 5 AI models from public access following a US government export-control directive. This directive prohibited "any foreign national" from using the services, leading to ongoing discussions between Anthropic and the White House. The company had previously warned that its Mythos model possessed advanced capabilities for both identifying and exploiting software vulnerabilities.

Anthropic acknowledged the "dual-use" nature of these AI models: the same queries beneficial for cybersecurity professionals could be dangerous in the hands of malicious actors. While Mythos 5 was released privately to a working group, Claude Fable 5, a similar model, was made public with restrictions on its ability to respond to biology and cybersecurity questions. The Trump administration, however, moved to restrict both models, citing national security risks, as it believed Fable 5's safeguards could be circumvented to access Mythos 5's full capabilities.

Experts argue that such restrictions are merely delaying an inevitable truth: similar AI capabilities will soon be prevalent across various companies and open-source developers. Tarah Wheeler, Chief Security Officer at TPO Group, noted that other companies likely possess similar AI capabilities and are observing the regulatory response to Anthropic. Logan Graham of Anthropic emphasized that the real issue is not just their models, but the impending widespread availability of these powerful AI tools.

This sentiment is echoed by researchers who believe that even existing AI offerings, with refinement, can be used for advanced vulnerability hunting and exploit development. Bruce Schneier from Harvard University highlighted that smaller, cheaper, open-source models, individually or combined, can already rival Mythos/Fable’s performance with sophisticated prompting. Experts recommend that governments focus on developing comprehensive, transparent plans to manage the inevitable advancements in AI capabilities, particularly in cybersecurity and other sensitive domains. Chris Wysopal of Veracode queried whether specific restrictions meaningfully reduce risk or merely hinder those striving to enhance system safety.