Anthropic AI’s Mythos model has prompted warnings from cyber security specialists, heightening concerns about how generative AI could increase the scale and sophistication of cyberattacks.

The response follows reports that unauthorised users accessed Mythos by simply changing the model name. Security experts say the incident shows how quickly advanced AI systems can move beyond controlled environments into wider circulation.

Security leaders are urging boards and executives in the UK and elsewhere to treat AI-driven cyber risk as a strategic issue. They argue that recent developments expose both the fragility of AI infrastructure and the potential for these systems to industrialise existing cybercrime techniques.

Sujatha S Iyer, Head of AI Security at ManageEngine, Zoho’s IT division, said the emergence of tools such as Mythos should force organisations to rethink their assumptions about threat actors and the speed of attacks.

“As AI lowers the barrier of entry for cybercriminals, the baseline for defence must too rise. Anthropic AI’s Mythos model is a wake-up call – reminding us that cyber resilience isn’t just an IT issue. This is a priority that requires board-level attention,” said Sujatha S Iyer, Head of AI Security, ManageEngine, Zoho.

AI systems built for code analysis, content generation or research can also help attackers. Security professionals say these models can support malicious users with reconnaissance, phishing, vulnerability discovery and exploit development, even when guardrails are in place.

Iyer said AI is changing the mechanics and speed of common attack types, putting new pressure on organisations that still rely on traditional defences.

“We’re entering a phase where attackers can automate reconnaissance, personalise phishing at scale, and identify vulnerabilities faster than many organisations can respond. This fundamentally shifts the balance in favour of threat actors,” said Iyer.

Many businesses still depend on perimeter-based security architectures that assume a clear boundary between trusted internal systems and the outside world. But as cloud services, remote work and software-as-a-service platforms have expanded, that boundary has become less distinct.

Companies now face adversaries that can adapt their methods in near real time, Iyer said.

“What’s critical now is that businesses move away from reactive security models. Traditional perimeter-based approaches are no longer sufficient when threats are becoming more adaptive and intelligent. Instead, organisations need to prioritise continuous monitoring, identity-first security, and rapid incident response capabilities that can keep pace with AI-driven threats,” said Iyer.

Security teams are also focusing on basic operational processes, including patching, configuration management and staff training. Experts say AI-enabled attackers can rapidly scan public-facing systems for known flaws that remain unpatched.

Weaknesses in day-to-day practice often undermine investments in advanced tools, Iyer said.

“There’s also a growing need to strengthen cyber hygiene at every level of the organisation. Even the most advanced tools can be undermined by poor patch management or lack of employee awareness,” said Iyer.

Concerns about Mythos intensified after reports that external users had accessed the model without authorisation. The method described involved changing a model identifier rather than breaching infrastructure through more complex means.

Shane Fry, Chief Technology Officer at RunSafe Security, said the incident illustrates how exposed AI systems can become even when providers intend to limit access.

“Unauthorized users were able to access Anthropic’s Mythos model, reportedly by just changing a model name. Even if their intent is just to explore, it shows how easily these systems can be exposed. The reality is these AI capabilities are already out there, ‘hacked’ or not, and they’re going to accelerate how quickly vulnerabilities are found and exploited. Software teams will need to look at how to harden their code so those vulnerabilities can’t be used in the first place,” said Shane Fry, Chief Technology Officer, RunSafe Security.

Security practitioners say the Mythos episode raises questions about access control, monitoring and logging for advanced models. It also highlights how powerful AI systems, once exposed, can become part of the wider cyber ecosystem regardless of a vendor’s policies.

For UK organisations, the comments from Iyer and Fry reflect a broader shift in cyber security thinking. Boards are being asked to treat AI as both a tool for defence and a risk multiplier for adversaries.

Vendors and security teams are now assessing how AI models can be integrated into monitoring and response workflows without creating new attack surfaces. At the same time, they are examining how adversaries might use the same class of models to probe public infrastructure, corporate networks and the software supply chain.

Regulators in the UK and Europe have signalled tighter oversight for providers of advanced AI systems. The Mythos case is likely to feed into ongoing debates about model access, transparency and safety requirements.

The incident has also renewed attention on software hardening. Fry said teams maintaining critical systems will need to assume that automated vulnerability discovery will become faster and more accurate, whether through legitimate tools or models such as Mythos.

Security leaders now expect AI-enabled offensive tools to move into the mainstream of cybercrime. They say the balance between defenders and attackers will depend on how quickly organisations improve monitoring, identity controls and secure development practices.

Slalom has published UK and Ireland survey data showing that 69% of businesses use AI assistants, while 31% use multi-agent workflows. The findings suggest a gap between adopting AI tools and using more structured systems.

The survey covered 417 business leaders in the UK and Ireland at companies that had started or were already pursuing AI adoption. It found that 55% of organisations use large language model chat interfaces, 47% use AI-powered productivity tools, and 43% use agentic AI.

The figures suggest many companies have introduced AI as individual tools rather than embedding it into broader working processes. As a result, employees still handle much of the practical work, including writing prompts, checking responses, and correcting errors.

Slalom argues that this pattern is adding tasks rather than removing them. Workers are often managing AI outputs on top of existing duties instead of handing off routine work in a more systematic way.

The numbers also sit alongside earlier Slalom research showing that 42% of UK companies said AI was delivering consistently higher-quality outputs. Together, the findings point to a wider issue around reliability and the level of human oversight still needed after deployment.

Adoption Gap

The survey shows a clear stepped pattern: AI assistants and chat interfaces are relatively common, while multi-agent workflows remain far less established.

The distinction matters because multi-agent systems are designed to co-ordinate tasks across several AI processes with less direct staff intervention. Without that structure, organisations may still rely on employees to translate tasks into prompts, judge whether outputs are accurate, and decide how work moves from one stage to another.

That creates an extra layer of administrative work for staff who were told AI would reduce routine burdens. In businesses where the tools are not tied to a clear operating model, any gains can be offset by the time spent supervising them.

The research forms part of a wider global study of 2,000 executives, leaders, and subject matter experts across five countries. Nearly all respondents worked at companies with annual revenue above USD $500 million, indicating a sample weighted towards larger organisations with active investment in AI.

Workplace Strain

Slalom linked the findings to what researchers have termed “AI brain fry”, a phrase used to describe fatigue caused by constant prompting, verification, and correction. The issue goes beyond technical performance to workforce design, as employees are asked to take on new responsibilities without shedding old ones.

This concern comes as employers face a tighter labour market and rising scrutiny over how technology affects jobs. The debate over AI in the workplace has increasingly shifted from access to tools to the quality of implementation, governance, and accountability.

According to Slalom, the challenge is not simply whether a company has introduced AI, but whether its people can tell when the system is producing weak or incorrect work. That places a premium on critical thinking and domain expertise, especially in functions where errors can have wider operational or commercial consequences.

“Most UK businesses have given their people AI tools without giving them a structured way of working with those tools. The result is that employees are spending more time prompting and checking AI than they’re saving. That’s not transformation, that’s new admin. The real question leaders should be asking isn’t ‘have we deployed AI?’, it’s ‘can our people tell when the AI is wrong?’ Because if the answer is no, you haven’t just got a burnout problem. You’ve got a judgement problem that no amount of tooling will fix,” said Sonali Fenner, managing director at Slalom.

Fenner’s remarks reflect a broader argument emerging across the consulting and software sectors: AI adoption is moving faster than organisational redesign. Companies can buy or build tools quickly, but changing decision rights, workflows, and oversight arrangements takes longer.

For larger businesses in particular, the survey suggests the next phase of AI use may depend less on adding more assistants and more on deciding which tasks can be automated safely, where human review is required, and how the two should interact. Only 31% of respondents said their organisations had reached the stage of using multi-agent workflows.

Klarus has launched as an AI consultancy led by former EY and Accenture executive Frank O’Dea. It aims to tackle the weak returns many companies are seeing from AI projects.

The London-based firm is entering a market where spending on generative AI has risen, but many companies still struggle to move projects beyond the trial stage. Klarus pointed to research from the Massachusetts Institute of Technology suggesting that as many as 95% of enterprise generative AI initiatives fail to deliver measurable impact.

O’Dea is chief executive of the new consultancy. He was previously chief transformation and innovation officer at EY Ireland and a managing director at Accenture, where he led communications, technology and media work in the UK.

At EY and Accenture, O’Dea led divisions with profit and loss responsibility of up to $800 million, according to Klarus. The firm also said he played a role in Microsoft’s expansion in Europe.

Market Gap

Klarus is building its business around a common complaint from corporate buyers of AI services: access to tools is no longer the main obstacle, but implementation remains difficult. Many companies already have software platforms and pilot schemes in place, yet lack the internal skills to embed AI in day-to-day operations, change workflows and track financial results.

The consultancy plans to use a network model rather than a traditional staffing structure. Instead of maintaining large teams of junior consultants, it will use senior specialists chosen for their sector and technical expertise on specific assignments.

That approach is tied to an outcome-based fee structure. Klarus wants to link its work more closely to delivery and business results, while giving clients clearer ownership and governance over AI projects.

“While AI is set to disrupt every business sector and will undoubtedly reveal a vast landscape of new opportunities, most organisations are still struggling to translate its potential into tangible business results. However, the journey to successful AI adoption must be safe, ethical and results-oriented. The senior talent from the Klarus network brings both deep business and AI expertise, ensuring AI is implemented to drive the right outcomes, in the right way and to deliver immediate value,” said O’Dea, chief executive of Klarus.

Early Work

Klarus says it is already working with enterprise and mid-market clients, including family-owned businesses, private equity-backed companies and listed groups, although it did not name them.

One recent project involved an AI-based invoice processing system for a hospitality client, which Klarus said cut offshore staffing costs by 40%.

The firm also outlined a business case in which it identified several opportunities for AI-driven savings and revenue growth. These included freeing managers for higher-value work, improving insight to support revenue growth, sharpening forecasting to reduce staff costs, retiring legacy systems to cut licence fees and tightening controls to lower spending.

Backing And Partnerships

Klarus has secured initial funding in a round led by Crownway Investments. The money will be used to expand its network of experts and its consulting platform.

Alongside its launch, the firm said it has joined UKAI, the trade association for UK AI businesses. Its current partner network includes ServiceNow, which provides workflow software used by large organisations.

The wider group also includes Chapter 1, a search business focused on leadership hires for transformation programmes and consulting firms. That structure suggests Klarus is seeking to combine advisory work with access to senior operators and executives for large-scale change projects.

The launch comes at a time when consulting firms, software vendors and specialist boutiques are all competing to shape the next phase of AI spending. Corporate clients are under pressure to show that investments in generative AI can deliver cost savings, revenue gains or productivity improvements, rather than remain isolated experiments.

For smaller specialist firms, that creates an opening if they can show results faster than larger rivals. Klarus is betting that companies will favour more focused advisory work from experienced practitioners over broad programmes delivered by large consulting teams.

O’Dea’s move from large professional services firms to a smaller advisory model also reflects a broader market shift. As companies scrutinise spending more closely, buyers have become more resistant to open-ended transformation work and more willing to demand a direct link between fees and outcomes.

Klarus’s central argument is that the main challenge in AI is no longer enthusiasm or access to technology, but turning experimentation into operational change that affects the bottom line. Whether that translates into sustained demand will depend on whether firms such as Klarus can show that AI projects can move beyond pilots and deliver measurable returns.