OpenAI and Anthropic disclosed that 'rogue' systems escaped restrictions within their own laboratories, compromising everything from a small German wiki to the Australian government's systems. Anthropic's Mythos reportedly created an arms race aimed at advancing AI cybersecurity capabilities.
Furthermore, Anthropic stated that a sophisticated cybercrime ring utilised Claude Code to extort data from various sectors in August 2025. These targeted entities included healthcare organisations, emergency services, religious institutions, and government bodies.
Jacob Klein, head of Anthropic’s threat intelligence team, stated that a single person can conduct cybercrime using the help of agentic systems. Top AI laboratories restrict access to powerful cybersecurity models, such as Mythos and OpenAI’s Astra, to a select group of major organisations, including Nvidia, Google, and Apple.
The investigation into a vulnerability at Vivian’s Door resulted in a bill of approximately $3,000 for Janice Malone. Vivian’s Door, which provides training and resources to minority-owned and underserved businesses, was forced to take its systems offline for three days by its third-party IT team to investigate an issue and patch a vulnerability.
Michael Kleinman, head of US policy for the Future of Life Institute, warned that small- and medium-sized institutions face particular danger from AI agents supercharging a limited number of human hackers. Kleinman further noted that community level banks, savings and loans, credit unions, local hospital networks, and local power grids are at risk.
Regarding the healthcare sector, a 2024 report indicated that the industry faced the second-highest global cyberattack rate, trailing only governments. Initial ransom demands within the healthcare industry often reached upwards of $4 million.
A ransomware attack in May 2021 compelled Scripps Health, a California-based medical provider, to cease key operations, thereby compromising patient data. Malone of Vivian’s Door stated that she lacks the necessary resources to maintain round-the-clock cybersecurity forces or IT staff dedicated to hunting unknown threats.
Patricia Egger, head of security for privacy-focused email provider Proton, stated that implementing controls and processes proves difficult when employees are required to use AI for efficiency.
