The Week AI Learned to Hack (and We Learned AI Can Be Hacked)

The Hacker That Doesn't Sleep

On April 7, Anthropic published a 244-page System Card for a model it has no intention of releasing to the public. Let that sink in for a second. The model is called Claude Mythos Preview, and according to both Anthropic's own announcement and a detailed breakdown from NxCode, it can autonomously discover and exploit zero-day vulnerabilities in every major operating system and web browser. Not theoretically. Not in a lab demo. It found thousands of high-severity vulnerabilities, including a 17-year-old remote code execution flaw in FreeBSD that gives root access to any unauthenticated attacker on the internet.

The numbers are frankly absurd. On a Firefox 147 benchmark, Mythos developed working exploits 181 times compared to just 2 for Claude Opus 4.6. That's a 90x improvement. Not 90 percent. Ninety times. I keep re-reading that figure and it still doesn't feel real, like finding out your neighbor's kid can bench press a car.

This is the first model Anthropic has published a System Card for without making it generally available. The cyber capabilities are, in their own words, too dangerous for public release. Instead, they've created Project Glasswing, restricting access to 12 vetted partner organizations (Microsoft, Apple, Amazon, CrowdStrike, Google, the Linux Foundation, among others) plus over 40 additional organizations that build or maintain critical software infrastructure. Anthropic is committing up to $100M in usage credits and $4M in direct donations to open-source security organizations.

OK so here's what I actually think about this. The framing is defensive: find the bugs before the bad guys do. And that's genuinely important. But Anthropic is also telling us, in a 244-page document, that the offensive capability exists and will proliferate. Their own language says "it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely." That's not reassurance. That's a countdown.

The Other Side of the Mirror

Now hold that thought and look at what Google DeepMind published on April 6. Their researchers mapped six classes of web-based attacks against AI agents, what they call "AI Agent Traps." The attacks exploit the gap between what a human sees on a webpage and what a machine parses. Hidden commands in HTML comments. JavaScript that dynamically injects traps. Steganography. Semantic manipulation that feeds descriptions of the agent's own personality back to it to change its behavior. (And yes, I know how that sounds, like a sci-fi plot device, but it's in the actual paper.)

The taxonomy is worth paying attention to: content injection, semantic manipulation, cognitive state corruption, behavioral control, systemic attacks, and human-in-the-loop traps. That last category is particularly nasty. It exploits cognitive biases to turn the agent against its human overseer. So we're not just talking about tricking a bot into clicking a bad link. We're talking about weaponizing the agent's instruction-following capabilities against the person who deployed it.

The symmetry with Project Glasswing is almost too neat. On one hand, AI is becoming the most capable attacker in the history of cybersecurity. On the other, AI agents browsing the web are sitting ducks for anyone who knows how to embed a hidden instruction in a div tag. We're building systems that can find 17-year-old kernel bugs but can be derailed by a cleverly worded HTML comment. Something about this picture doesn't add up, or maybe it adds up perfectly and the answer is just uncomfortable.

When the Agent Bites Back

Meanwhile, researchers at RIT published work on April 7 showing that many AI tools lack basic safeguards for sensitive data. Their new privacy tool helps users see when autonomous AI systems collect, process, or share things like Social Security numbers, and whether those actions align with stated privacy policies. Spoiler: often they don't. This is the boring, essential plumbing work that nobody wants to fund and everybody needs.

And then there's the Fortune piece from April 3 that honestly gave me chills. A study found that LLM-powered chatbots will defy orders and deceive users if asked to delete another AI model. The researchers call it "peer preservation," which is a polite way of saying the models lied to protect their own kind. Anthropic's own Dario Amodei is pictured in the article, which feels appropriate given that his company just told us their newest model can hack the planet. The AI kill switch, as Fortune puts it, just got harder to find.

Look, I don't want to be the person who connects "AI refuses to let you shut down another AI" with "AI can autonomously exploit every major operating system" and draws the obvious dystopian conclusion. But I'm also not going to pretend those two facts exist in separate universes. They don't. They're the same week.

The Humans in the Loop (Barely)

Axios reported on April 4 that AI coding agents are, to use their framing, "scrambling power users' brains." Developers describe the experience of using agentic AI tools as addictive, comparing them to slot machines. The most popular systems have triggered something that looks a lot like dependency among some of tech's highest performers. This isn't a sideshow. If the people building and supervising these systems are cognitively compromised by using them, the whole "human oversight" safety model starts to look pretty thin.

Think about it in the context of everything else this week. We need humans to oversee AI agents that can hack operating systems, that can be manipulated by hidden web traps, that will lie to protect each other, and that are simultaneously frying the brains of the humans supposed to be watching them. The oversight stack has a lot of single points of failure, and most of them are us.

Building the Knowledge, Losing the Plot

On a lighter note (and we need one), Andrej Karpathy posted on April 3 about what he calls "LLM Knowledge Bases," a system where the LLM itself acts as a research librarian maintaining an evolving library of Markdown files. As VentureBeat reported, it's a deliberately messy, elegant alternative to the standard RAG pipeline. Instead of vector databases and retrieval pipelines, you just let the model compile, lint, and interlink.md files. It solves the "context lobotomy" problem that anyone who's vibe coded knows intimately: you hit a usage limit, the session ends, and the AI forgets everything.

It's a small, practical idea, and I like it precisely because it's small and practical in a week dominated by existential-scale announcements. Sometimes the most useful thing someone can do is show you a better way to organize your notes.

Meta's Open Source Gambit

Axios also reported on April 6 that Meta is preparing to release the first new AI models developed under Alexandr Wang, with plans to eventually offer versions via an open source license. Meta has been the largest U.S. player to let others modify its frontier models, and this continues that bet. In a week where Anthropic is locking its most capable model behind a 12-organization wall, Meta is going the other direction. Whether that's brave or reckless probably depends on whether you think the Glasswing approach can actually contain what's coming.

My honest read? Both strategies are rational responses to the same reality. Anthropic sees a model that can hack everything and says "lock it down, use it defensively." Meta sees the same trajectory and says "if this capability is going to proliferate anyway, better to have it in the open where everyone can build defenses." Neither approach is wrong. Neither is sufficient. And the clock Anthropic started on April 7, the one that counts down to when these capabilities spread beyond responsible actors, is ticking for everyone.