Anthropic

55 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

Prompt Injection Risk: Claude 4.7 Agentic Tool Expansion

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 20, 2026

Anthropic's published system prompt diff between Claude Opus 4.6 and 4.7 reveals significant expansions in agentic tool access, autonomous browsing capabilities, and child safety guardrails — changes with direct security implications for prompt injection and excessive agency risks. The new `tool_search` mechanism and acting-before-asking posture increase the attack surface for adversarial inputs targeting agentic Claude deployments. Transparency in publishing these changes is notable, but the expanded autonomous capabilities warrant scrutiny from defenders.

Autonomous Exploit Generation: Claude Mythos Risk

ATLAS OWASP HIGH ▲ 8.5 Schneier on Security Apr 20, 2026

Bruce Schneier analyses Anthropic's Claude Mythos Preview and Project Glasswing, a controlled deployment programme aimed at finding and patching software vulnerabilities before the model is publicly released due to its advanced cyberattack capabilities. The piece highlights a growing offensive AI capability gap, noting that newer LLMs can autonomously chain memory corruption bugs and operationalise exploits without human orchestration, while observing that defenders currently retain a marginal advantage because vulnerability discovery is easier than exploitation. Schneier warns that this advantage is narrowing rapidly and that the industry must prepare for a world of commoditised zero-day exploits.

GPT-5.4-Cyber Expansion Raises LLM Jailbreak Dual-Use Risks

ATLAS OWASP MEDIUM ▲ 6.5 SecurityWeek Apr 17, 2026

OpenAI has expanded access to GPT-5.4-Cyber, a fine-tuned model designed for defensive cybersecurity applications, following Anthropic's reveal of its Mythos cybersecurity model. While framed as a defensive tool for legitimate security practitioners, the widened access to a capability-enhanced cybersecurity LLM raises dual-use concerns around potential misuse for offensive operations. The competitive dynamic between major AI labs in the security-focused model space signals a broader industry trend that warrants careful access control and policy scrutiny.

Anthropic MCP Supply Chain Flaw Enables Command Injection

ATLAS OWASP CRITICAL ▲ 9.1 SecurityWeek Apr 16, 2026

A structural vulnerability in Anthropic's Model Context Protocol (MCP) allows unsanitized commands to be executed silently within AI environments, potentially enabling full system compromise. Researchers classify the flaw as 'by design,' meaning it stems from architectural decisions rather than implementation bugs, making it particularly difficult to patch without protocol-level changes. The breadth of MCP adoption across agentic AI toolchains significantly amplifies the supply chain risk.

Claude Code Source Leak Exposes 512K Lines of Code

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 16, 2026

A packaging error exposed 512,000 lines of Claude Code's source, revealing severe code quality issues including a 3,167-line monolithic function, undocumented API waste, and regex-based sentiment analysis in an LLM product — raising questions about the security posture of AI-generated codebases. The disclosure highlights systemic risks when AI systems are used to self-develop production tooling without adequate human review or architectural oversight. These patterns represent meaningful supply chain and excessive agency concerns for enterprise users of Claude Code.

Anthropic Claude Mythos Sparks AI Vulnerability Storm Warning

ATLAS OWASP HIGH ▲ 7.2 Dark Reading Apr 14, 2026

The Cloud Security Alliance has issued a warning about an anticipated 'AI vulnerability storm' following the release of Anthropic's Claude Mythos model, urging CISOs to prepare defensive postures in advance of expected exploit activity. The advisory signals growing institutional concern that major LLM releases create systemic risk windows as adversaries probe new model capabilities and attack surfaces. Security leaders are being advised to treat post-release periods of frontier AI models as high-alert intervals requiring elevated monitoring and response readiness.

Anthropic Claude Prompt Injection Enables Excessive Agency

ATLAS OWASP LOW ▲ 6.2 CrowdStrike Blog Apr 11, 2026

CrowdStrike, as a founding member of Anthropic's Mythos program, is highlighting the security challenges posed by increasingly capable frontier AI models, signaling a growing industry focus on securing agentic and large-scale AI systems. The article underscores the philosophical and practical position that AI capability gains must be matched by proportional security investment. While the piece is primarily a vendor partnership announcement and executive viewpoint, it reflects an important industry trend toward formalising AI-specific security frameworks and tooling.

US summons bank bosses over cyber risks from Anthropic's latest AI model

ATLAS OWASP CRITICAL ▲ 8.5 HN AI Security Apr 10, 2026

The US Treasury convened major bank executives to discuss cybersecurity risks posed by Anthropic's unreleased Claude Mythos model, which the company claims has surpassed nearly all human experts at finding and exploiting software vulnerabilities. A code leak prompted Anthropic to publicly acknowledge the model's unprecedented offensive cyber capability, raising systemic financial sector risk concerns. The meeting signals growing regulatory awareness of AI-enabled cyber threats to critical financial infrastructure.

Anthropic Mythos AI Autonomously Discovers Zero-Day Exploits

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Apr 10, 2026

Anthropic has released a preview of 'Mythos,' an AI model reportedly capable of autonomously discovering and exploiting critical zero-day vulnerabilities, raising significant dual-use concerns. While Anthropic claims the model ships with access controls, the security community is scrutinising whether those safeguards are sufficient to prevent misuse by malicious actors. The development represents a pivotal moment in the arms race between offensive AI capabilities and defensive governance frameworks.

Claude Source Code Leak Reveals AI Supply Chain Risk

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Apr 03, 2026

A reported source code leak affecting Claude, Anthropic's large language model, underscores systemic weaknesses in AI software supply chains and the absence of robust oversight mechanisms at critical development and distribution layers. The incident highlights how proprietary model code, training pipelines, and system prompts can become high-value targets for adversarial actors seeking to enable model theft, backdoor insertion, or competitive intelligence gathering. This event serves as a broader warning about treating AI development infrastructure with the same rigor applied to other critical systems.

Anthropic

Stay ahead of the threat.