Power Companies Are Pointing Anthropic’s Mythos at Their Own Software. Finding the Flaws Was the Easy Part.
Bloomberg reports that US utilities, including Duke Energy, are now testing Anthropic’s Mythos models to hunt for software flaws in their own systems. Duke’s chief security officer, Martin Strasburger, is described as saying Anthropic enabled utilities to use the tools late this summer, after some power companies spent months urging government officials and the company to give them access.
The harder question, which Anthropic's own framing and POWER magazine both point to, is what happens after a model finds a bug in a substation that cannot be taken offline to fix it.
- 11 — founding partners in Anthropic's Critical Infrastructure Defense Program, including Dragos, Nozomi Networks, Rockwell Automation and Hitachi · Source: SiliconANGLE, Oct. 8, 2026
- 29,000+ — candidate vulnerabilities found in widely used software over six months, of which staff had manually reviewed about 6,000 · Source: SiliconANGLE, Oct. 8, 2026
- 10-fold — JPMorgan CEO Jamie Dimon's description of how AI cyber risk rose after Mythos · Source: Bloomberg, Oct. 6, 2026
According to Bloomberg’s November 11 report, utilities are folding Mythos into their cyber defenses with a narrow goal: find vulnerabilities in their own code before an attacker does. Duke Energy is the named example. The report says some power companies had lobbied for access for months, which is itself a data point: the sector most exposed to a physical consequence from a software bug was waiting in line for the tool.
We could not read the full article, so details beyond the summary, including how many utilities participate and what, if anything, federal agencies contributed, are not reported here.
Anthropic announced Project Glasswing on April 7, a coalition of 12 technology companies using the then-unreleased Claude Mythos Preview to find flaws in critical software. POWER magazine reported that the model had surfaced thousands of previously unknown vulnerabilities, including an OpenBSD flaw undetected for 27 years. On April 21, Bloomberg reported that a small group of unauthorized users had reached the model through a third-party vendor environment; Anthropic said it was investigating and had no evidence its own systems were affected.
In early October, per SiliconANGLE, Glasswing was folded into an expanded Cyber Verification Program, and on October 8 launched a Critical Infrastructure Defense Program that gives security firms protecting power grids and water systems access to its models and on-site engineers. Commercial terms were not disclosed, including who pays for compute. Two days earlier, JPMorgan’s Jamie Dimon told Bloomberg that AI-driven cyber risk had gone up ten-fold after Mythos.
Anthropic’s own framing, as SiliconANGLE summarizes it, is that finding vulnerabilities is now easy while verifying, prioritizing and fixing them is still hard.
That is the crux for utilities. POWER notes that substation, SCADA and energy-management systems often run decades-old software, that fixes can require planned outages, vendor coordination and regulatory approval, and that the gap between discovery and deployed patch is measured in months or years. Where patching is impossible, the recommended answer is compensating controls such as network segmentation and added monitoring. A scanner that finds more bugs makes that list longer before it makes the grid safer.
Anthropic says Glasswing has not yet reduced cyber risk enough, and expects AI to favor defenders within two years. Both are the company’s own assessments. The same capability that helps a utility audit its code is the one Dimon and others describe as raising the threat, which is why who gets access, and who verifies the results, is the story to watch.
Civic Intelligence uses Claude, a model made by Anthropic, in its editorial workflow. Weigh this page accordingly.
Utilities now have an AI that finds software flaws faster than the grid can fix them. Access was the fight in the spring; the repair queue is the fight now.
