💸 Mythos and the mispricing of everything
The moment AI capability and AI danger became permanently inseparable
A lot has been written about Claude Mythos Preview in the past few days, so I’ll spare you a recap. Anthropic’s blog post and Simon Willison’s overview are the places to start if you need to get up to speed. What I want to do in this essay is to focus on the part of this story that I think has been underweighted.
The most significant and immediate implication of Mythos is on how we price risk. Critical infrastructure is the asset class that is most exposed and is systemically mispriced. The US utilities sector alone has a $1.5 trillion market capitalization, priced at roughly 22x PE – with cyber risk treated as an incremental operational cost rather than a structural exposure. That frame no longer works in a world where an AI agent can autonomously construct working exploits overnight.
This is not a marginal change to the threat landscape. Every institution that prices cyber risk – insurers, infrastructure investors, governments – has built its models on one foundational assumption: that offensive capability requires scarce human expertise. Mythos removes that scarcity. It’s not surprising that Treasury Secretary Scott Bessent convened Wall Street CEOs at short notice. Bessent understood the systemic risk quickly, but markets have yet to reach the same conclusion.
Anthropic understands the danger and has created a new institution – Project Glasswing, a coalition that brings together twelve major technology partners – with greater control over this capability than most governments currently possess.
It’s a response to a serious problem. It is also entirely voluntary, built on trust rather than law, and accountable to the people who built what’s being governed. The labs decide what to disclose, when, and to whom. There is no meaningful independent verification, no democratic mandate, no mechanism by which the public – whose infrastructure is at stake – has any formal say.
Today, Glasswing controls one model, from one lab. It governs nothing about what Meta, a Chinese research institute, or a well-funded independent team releases in 2027. The containment is temporary: The next models will be more powerful, better aligned and still capable of deception and harm. What is contained today will become ambient.
The market hasn’t caught up
The $20 billion cyber insurance market is predicated on the wrong model. Most premiums are based on well-known ransomware, data breach and extortion patterns following standard attack vectors, monetization demands and deployment patterns, all of which can be modeled from experience over the previous decade.
