The AI That Broke Everything — And Put AI Guardrails on the US-China Agenda

Correction (October 9, 2026): An earlier version of this article said Trump spoke after stepping off Air Force One on Thursday; he spoke to reporters aboard the plane on Friday, May 15. It also overstated Mythos's findings: Anthropic reported "thousands," not tens of thousands, of vulnerabilities; Mythos was used to find 271 Firefox bugs, versus 22 for an earlier model; and the 27-year-old OpenBSD bug allowed remote crashes rather than being shown as an exploit. We removed an unsourced claim that China used earlier AI talks to gather intelligence and clarified that Kemba Walden's "hack nearly anything" line was the headline of her Fortune op-ed, and that she served as acting national cyber director. The headline previously said Mythos forced a US-China summit; the Beijing summit was already scheduled, and the headline now reflects that AI guardrails were added to its agenda.

When President Trump flew home from Beijing on Friday after the first US presidential visit to China since his own 2017 trip, reporters on Air Force One expected to hear about tariffs. Instead, he told them he and Xi Jinping had talked about "possibly working together for guardrails" on artificial intelligence. Pressed on what kind of guardrails, he offered few specifics. But something had clearly changed. The question worth asking is: what finally moved this issue from think-tank papers to an Oval-to-Zhongnanhai conversation?

The answer, more than anything else, is a model called Mythos.

What Anthropic's Mythos Actually Did

Mythos is not a chatbot. It's Anthropic's most capable reasoning model, built for autonomous multi-step tasks — and in its preview run, it turned that capability toward vulnerability research. The results were staggering. According to Anthropic's technical write-up, Mythos found and exploited a 17-year-old remote code execution vulnerability in FreeBSD (CVE-2026-4747) with no human involvement after the initial request, and found a 27-year-old bug in OpenBSD that let an attacker remotely crash machines — in one of the most security-hardened operating systems on the planet, the kind used to run firewalls and critical infrastructure. In Firefox, an earlier Anthropic model, Claude Opus 4.6, had turned up 22 security bugs; Mozilla fixed 271 found with Mythos in Firefox 150. Across all surveyed software, Anthropic reported thousands of high- and critical-severity vulnerabilities.

The vulnerabilities Mythos uncovered weren't just old — they were unpatched. At the time of Anthropic's report, it said over 99% of what the model had found had not yet been patched. And Mythos didn't stop at discovery: it built and chained exploits, writing in hours what experts said would take weeks. Kemba Walden, who served as acting US national cyber director, put it bluntly in a Fortune op-ed headlined "Anthropic's 'Mythos' AI can hack nearly anything and we aren't ready." That's not an anonymous think piece. That's a former senior official's on-record assessment.

The Controlled Release That Couldn't Stay Quiet

Anthropic's response was Project Glasswing: a controlled distribution program that gave 11 launch partners and more than 40 additional organizations early access to Mythos specifically to let defenders scan and patch critical systems before attackers could exploit the same findings. The idea was to use the offensive capability in service of defense — let the model race ahead of the bad actors on behalf of the good ones.

It was a reasonable approach. It also couldn't contain the story. The sheer scale of what Mythos found — thousands of vulnerabilities, in software underpinning everything from banks to government systems — leaked into the policy world fast. Operational technology providers excluded from the Glasswing rollout were, per Nextgov, feeling "annoyance." And governments, whose critical infrastructure sat squarely in the blast radius, started paying attention in a way they hadn't before.

Why This Is Different From Every Other AI Safety Scare

The standard AI safety discourse runs on hypotheticals: what might a sufficiently advanced model do? Mythos replaced that frame with evidence. It didn't theorize about hacking critical infrastructure — it found real, exploitable, unpatched vulnerabilities in the actual software running real infrastructure, at a scale no human team could match. The threat became empirical.

That shift matters enormously for geopolitics. For years, US-China AI dialogue — including the official channel the Biden administration launched in 2023 — made limited progress, with US experts focused on safety and China focused on US export controls on AI chips. Neither side had a specific, shared technical problem to anchor coordination. Now there's a concrete frame: what happens if a Mythos-class model, operating without Glasswing-style constraints, gets into the hands of a non-state actor — or a state that sees asymmetric infrastructure disruption as a military option? Treasury Secretary Scott Bessent framed the talks precisely this way: the two sides would set up a protocol on "best practices for AI" to "make sure nonstate actors don't get a hold of these models."

A Geopolitical Threshold Just Got Crossed

The Trump-Xi AI conversation isn't a treaty. It doesn't even have a named channel yet — a White House official said "what that channel of communication looks like and its formality … is yet to be determined." And there's real reason for skepticism: China's track record in these dialogues is not encouraging, and Trump's description of "the guardrails that we talk about all the time" revealed he has no specific mechanism in mind.

But something structurally important happened anyway. Frontier AI has entered the same category of geopolitical concern as chips, nuclear safeguards, and defense systems. The conversation that policy analysts have been trying to force for years — a bilateral US-China channel specifically for AI risk coordination — now has a presidential mandate, however vague. That's a different baseline than existed three months ago.

What to Watch

Anthropic's Glasswing program will expand. More models at this capability level will ship, from more labs. The 99%-unpatched figure Anthropic reported is a timer. The interesting question isn't whether AI changes the cybersecurity landscape — Mythos already answered that. The question is whether the defensive deployment of these models can outpace the offensive risk they represent, and whether the geopolitical infrastructure for coordination can be built fast enough to matter. Two governments are at least now saying the right words. The gap between words and working guardrails, in AI as in every prior arms control context, is where everything either gets built or falls apart.

Sources: Anthropic: Mythos Preview · Anthropic: Project Glasswing · The Hill via AOL · Fortune · The Next Web · Nextgov/FCW