Report: Mythos-Like AI Tools Raising Healthcare Cyber Stakes

Report: Mythos-Like AI Tools Raising Healthcare Cyber Stakes Déjà Vu: Is Mythos in Hands of Bad Actors Akin to Cobalt Strike, Brute Ratel Abuse? Marianne Kolbasuk McGee (HealthInfoSec) • May 18, 2026     Credit Eligible Get Permission Image: Getty Images Anthropic's Claude Mythos and similarly powerful artificial intelligence tools pose elevated cyber risk to the healthcare sector, warns a new report. See Also: AI Impersonation Is the New Arms Race-Is Your Workforce Ready? Mythos, currently restricted to roughly 50 vetted Project Glasswing organizations, could still "create a force multiplier for criminal elements if leaked," warned the threat research report by the Health Information Sharing and Analysis Center and medical laboratory firm Quest Diagnostics (see: Anthropic Calls its New Model Too Dangerous to Release). That's happened before with seemingly less dangerous tools, including the command-and-control frameworks Cobalt Strike and Brute Ratel, the report said. "Both tools were created to help enterprise red teams better assess security at their organizations, but both ended up being used by threat actors, by purchasing cracked versions of the software or getting legitimate access by misleading the developers, to launch malicious cyberattacks." With its ability to autonomously discover and exploit decades-old vulnerabilities with minimum human oversight, "Claude Mythos Preview represents a genuine inflection point in AI-driven cybersecurity," the report said. "The parallels to Cobalt Strike and Brute Ratel are not abstract; they are a documented pattern of legitimate security tools becoming weapons in adversarial hands." Anthropic is investigating a claim reported by news outlet Bloomberg that a group of Discord users gained access to the Mythos model, the report notes (see: Report: Discord Group Uses Claude's Supposedly Secret Mythos). Cobalt Strike developer Fortra, Microsoft and the Health ISAC in 2023 obtained a U.S. federal court order redirecting into sinkhole servers the internet traffic from Cobalt Strike-infected computers sent to command-and-control centers controlled by bad actors (see: Microsoft Gets Court Order to Sinkhole Cobalt Strike Traffic). Brute Ratel, a "Cobalt-like" alternative toolkit for red-team pen testing, has been deployed by cybercriminal gangs, including the now-defunct Russian-speaking BlackCat threat actor, also known as AlphV, to launch healthcare sector attacks (see: BlackCat Adds Brute Ratel Pentest Tool to Attack Arsenal). Experts advise the healthcare sector to assess the growing risk posed by Mythos and similarly powerful AI tools. "Healthcare CISOs and security teams need to understand that with Mythos, the speed of vulnerability detection and exploitation will be increased exponentially," said Denise Anderson, CEO of Health-ISAC. Teams will need to speed up patch cycles and develop plans for taking devices offline to patch, she said. "Third-party partners and legacy systems are always going to be the biggest risk. Companies will need to lean more heavily into moving off legacy systems whenever possible and continue to develop and implement mitigating controls around third-party tools and legacy systems," she said. Addressing the onslaught of newly discovered bugs will require healthcare organizations to evolve their vulnerability mindsets, said Jason Elroy, CISO of MultiCare Health System in Washington. "I have to do it at AI speed now," he said. "It's like, 'hey, we found a vulnerability, we now have an exploit for the vulnerability.' The moment that happens, you've got 20 to 30 minutes, maybe - 24 hours tops in this new world," said Elrod, who is also an executive advisor at security firm Elisity. "The velocity is really what has been the impact. It's a shift from vulnerability management to exploitability management. That's where the idea of micro-segmentation, zero trust, limiting the bandwidth, come into play," he said. The emergence of tools like Mythos may not be all bad. It could bolster the healthcare sector's cybersecurity posture, some experts said. "Hopefully, Mythos and other tools will be used effectively by software developers to build more secure software going forward," said Scott Gee, deputy national cyber risk adviser at the American Hospital Association. "This should truly shift the focus of software developers to 'secure by design' where security is emphasized throughout the development process, rather than a focus on delivering new features with security being almost an afterthought."