Anthropic CEO Says Fixing Vulnerabilities Is Harder Than Finding Them

Anthropic CEO Dario Amodei said Anthropic and its customers have each found hundreds of thousands of software vulnerabilities, making the slower work of repairing them the next major security challenge.

Amodei said Anthropic devoted much of its effort to finding software flaws after introducing its Claude Mythos model. The company has begun offering remediation services, and Claude’s ability to repair vulnerabilities is improving. He described a gap between discovery and repair, saying organizations cannot fix the issues as quickly as they are found.

JPMorgan Chase CEO Jamie Dimon said the bank has thousands of cybersecurity workers. He estimated that perhaps more than 10,000 people are working to fix some vulnerabilities exposed by Mythos. That figure describes a repair effort separate from Amodei’s account of the hundreds of thousands of flaws found by Anthropic and its customers. JPMorgan participates in Anthropic’s Glasswing cybersecurity program. Dimon said 250,000 JPMorgan employees use Claude several times a week.

Dimon said cybersecurity was among JPMorgan’s biggest risks even before Mythos and AI agents entered the picture. He described continuously operating agents as posing a threat across nearly every company boundary. He also said many critical infrastructure industries lack protection and will eventually need help catching up.

Amodei described writing safer software from the outset as the next step after finding and repairing flaws. Anthropic has begun offering tools to help developers write secure code and is training Claude to produce more secure programs. That work focuses on preventing flaws in new software, while remediation services address existing vulnerabilities.

Amodei said the next stage is for companies to deploy groups of agents that monitor their servers in real time. He expects attacks launched by groups of agents to become more common within six to 12 months, creating a need for defensive agents. The comments point to a shift from finding and fixing flaws toward continuous monitoring.

Security also constrains how regulated companies connect agents to sensitive information, Amodei said. He compared the challenge with self-driving cars, saying perfect safety cannot be guaranteed but setting a goal of making systems 100 or 1,000 times safer than human operation.