How Claude Mythos Wiped Billions Out Of Cybersecurity Stocks - Forbes

MoneyInvesting How Claude Mythos Wiped Billions Out Of Cybersecurity Stocks ByJon Markman, Contributor. Forbes contributors publish independent expert analyses and insights. Analyzing tech stocks through the prism of cultural change. Follow Author Apr 14, 2026, 10:26am EDT --:-- / --:-- This voice experience is generated by AI. Learn more. This voice experience is generated by AI. Learn more. A smartphone displays the Project Glasswing logo with the dedicated webpage in the background, in Creteil, France, on April 8, 2026. Anthropic announces the launch of Project Glasswing, a cybersecurity initiative based on the Claude Mythos model to detect and remediate vulnerabilities in critical open-source software. (Photo by Samuel Boivin/NurPhoto via Getty Images) NurPhoto via Getty Images In late March, Fortune discovered that Anthropic had accidentally left a draft blog post about a new model called Claude Mythos in an unsecured, publicly accessible data cache. The draft described the model as "far ahead of any other AI model in cyber capabilities" and warned it could spark a wave of advanced attacks. Cybersecurity stocks immediately cratered. The iShares Cybersecurity ETF lost 4.5%. CrowdStrike fell 7%, Palo Alto Networks dropped 6%, Zscaler and SentinelOne each fell around 6%, Okta and Netskope lost more than 7%, and Tenable plummeted 9%. Then on April 7, Anthropic officially announced Claude Mythos Preview and Project Glasswing. A second, larger selloff hit on April 10: CrowdStrike dropped around 8%, Cloudflare fell more than 13%, and the rest tumbled again. The S&P 500 Software and Services Index dropped 2.6% on April 9 alone, extending its 2026 decline to 25.5%, making it one of the worst-performing segments of the US market this year. The fear driving the selloff is simple: if an AI can autonomously find and exploit vulnerabilities that 27 years of human review missed, what exactly are cybersecurity companies selling? PROMOTED What the Market Is Pricing In The market is pricing in the possibility that AI makes traditional cybersecurity products less valuable. The logic: if models like Mythos can find zero-day vulnerabilities in every major OS and browser, then the defense side needs to move equally fast, and the companies that move fastest might not be the incumbents. That fear has some basis. Anthropic's own testing showed Mythos identified thousands of zero-day vulnerabilities across every major operating system and web browser. It found a 27-year-old bug in OpenBSD, a 16-year-old flaw in FFmpeg that survived 5 million automated scans, and autonomously built a full remote root exploit on FreeBSD. It scored 83.1% on CyberGym versus 66.6% for the previous best model. CrowdStrike CTO Elia Zaitsev acknowledged the threat directly: "The window between a vulnerability being discovered and being exploited by an adversary has collapsed." MORE FOR YOU But the selloff conflates two different things: the threat AI poses to software security, and the threat AI poses to cybersecurity companies. These are not the same. Why the Selloff Is Overblown Phil Stock World published a detailed analysis of what Claude Mythos actually threatens for each major cybersecurity company. The conclusion: the companies selling off hardest are largely not the ones most exposed. CrowdStrike's Falcon platform provides endpoint protection, threat detection, and response across live networks. Claude Mythos finds vulnerabilities in source code. These are completely different problems. CrowdStrike is actively building AI into Falcon, including new AI runtime protection and shadow AI discovery launched at RSA 2026. The company is a Glasswing partner, not a victim of it. Zscaler's core business is inspecting live internet traffic through a Zero Trust Exchange. Mythos reads code in a repository. Again, different problems. Rubrik, which focuses on data resilience and recovery, arguably benefits from Mythos: if AI makes attacks more sophisticated, the value of bulletproof recovery capabilities increases. Rubrik's subscription ARR reached $1.46 billion as of January 2026, up 34% year over year. Seeking Alpha's Steve Cress called the selloff fear-driven and not permanent: "A lot of what we're seeing is being generated by fear and negative sentiment." Market analysts at Interactive Brokers noted the selloff reflects "prior software-specific concerns stemming from AI and private credit that are coming back to the fore," not a rational repricing of these specific companies' revenue models. What Mythos Actually Validates The deeper signal is not that cybersecurity is broken. It's that AI is accelerating the entire vulnerability lifecycle, from discovery to exploitation to patching, in ways that make the total security workload larger, not smaller. Mythos can find bugs faster than any human team. It can also help fix them faster. Anthropic is committing $100 million in usage credits to Project Glasswing partners specifically to patch the vulnerabilities the model discovers. After the credits expire, Mythos Preview is available at $25/$125 per million input/output tokens through the Claude API, Amazon Bedrock, Google Cloud's Vertex AI, and Microsoft Foundry. AWS confirmed Claude Mythos Preview as a gated research preview on Bedrock, available to invited customers through Project Glasswing. The infrastructure thesis is straightforward. Models like Mythos require enormous compute to train and run. The companies providing that compute, AWS, Google Cloud, Microsoft Azure, are the platforms through which enterprise customers access these capabilities. Every organization that uses Mythos to audit its code does so through one of these cloud providers, paying per-token for the privilege. The more powerful AI security tools become, the more inference compute they consume, and the more revenue flows to the infrastructure layer. Correcting the Record The draft article contained several claims that don't hold up. "Claude Mythos exposed a fortress that human experts spent years building" and "the Ghost repository" do not correspond to any documented event. There was no "Ghost breach." The cybersecurity stock selloff was triggered by Fortune's March 26 leak of Anthropic's draft blog post, followed by the official Project Glasswing announcement on April 7. The selloff was about the implications of AI for the cybersecurity industry, not about a specific breach of any repository. "Anthropic confirmed that Mythos is the first model trained entirely on Nvidia's new GB3 chips." There is no Nvidia chip called GB3 in any published documentation. Anthropic has not publicly disclosed the specific hardware used to train Mythos Preview. The claim is fabricated. "By owning the largest clusters of GB3 hardware, [hyperscalers] own the only machines capable of running models like Mythos." Mythos is available through Amazon Bedrock, Google Cloud's Vertex AI, and Microsoft Foundry, all three major cloud platforms, plus Anthropic's own API. No single hyperscaler has exclusive access. "Amazon is launching Claude Mythos on its Bedrock framework to secure a critical first-mover advantage." Bedrock is one of four access points. Google's Vertex AI and Microsoft's Foundry offer the same model to the same Glasswing partners. There is no first-mover advantage here. The Real Investment Framework The cybersecurity selloff created a genuine dislocation. Companies like CrowdStrike and Palo Alto Networks sold off 6-13% on fears about a technology that they are actively integrating through Glasswing. That's the market punishing companies for a threat they're already positioning to monetize. The infrastructure providers (AWS, Google Cloud, Azure) benefit regardless of whether AI helps attackers or defenders, because both sides consume compute. Every security audit, penetration test, and vulnerability scan run through Mythos generates inference revenue for the cloud platform hosting it. The actual losers from AI-augmented cybersecurity are narrower than the market selloff implies. Static code analysis tools, manual penetration testing firms, and legacy vulnerability scanners face real disruption. The network security and endpoint protection companies that sold off hardest operate in adjacent but different markets from what Mythos does. The S&P 500 Software and Services Index is down 25.5% since January. Some of that decline is warranted by the structural shift AI represents. Much of it is the market's inability to distinguish between companies that AI threatens and companies that AI empowers. That distinction is where the opportunity lies. If you liked this, you’ll love the daily dose we send to our Substack crew. It's chill, it's sharp, and it actually helps. Hop on here. Editorial StandardsReprints & Permissions Visit Jon's website. Follow Author LOADING VIDEO PLAYER... FORBES’ FEATURED Video