You may have missed the recent announcement that Anthropic has an AI that can find vulnerabilities in software systems and exploit them. Humans have failed to discover these exploits, despite numerous audits, for over 20+ years. It turns out humans are really bad at writing secure software code.
Now, maybe you heard about this and figured it was a Silicon Valley problem. Something for the Googles and Microsofts of the world to worry about. You’ve got keys to cut and orders to place and a truck that needs new tires.
Fair enough. But give me five minutes, because this one actually matters to you.
What They Found
Anthropic’s new AI — they’re calling it Mythos — went looking for flaws in widely-used software. It found thousands of them. Critical ones, in every major operating system and every major web browser. grc Not new software. Not obscure stuff. One bug had been hiding in OpenBSD — an OS specifically built around security — for 27 years. Another undetected bug was a 16-year-old bug hiding in FFmpeg, a video library so thoroughly tested that entire research papers have been written about how to fuzz it — and automated tools had hit the vulnerable line of code five million times without catching the problem. grc
Twenty years. Five million automated tests. Nobody caught it.
The uncomfortable part is this: Anthropic found that engineers with no security training at all could point Mythos at a piece of software before bed, and wake up to a working exploit. grc That’s what changed. Finding these holes used to require years of expertise. Now it requires a laptop and a subscription.
Okay, But What Does That Have To Do With My Business?
Let’s talk about your supply chain, because that’s where this gets real.
Your shop has a website. Maybe it takes bookings, maybe it just has a contact form — doesn’t matter much, both are doors. You’ve got email, probably hosted somewhere. Your distributor almost certainly has an online ordering portal you log into. And somewhere up the chain, there’s a manufacturer running software that connects to the outside world.
Every one of those is a target. Not because someone has it out for locksmiths specifically — but because attackers don’t work that way anymore. They scan everything, automatically, looking for anything that’s old or unpatched or misconfigured. The industry has been shipping “good enough” software for decades, and AI is about to call in every outstanding debt on that. grc
When your distributor gets hit, your account credentials and order history go with it. When your email gets hijacked, your customers start receiving fake invoices that look exactly like yours. When your website gets quietly compromised, it starts serving malware to anyone who visits. None of this requires you to be specifically targeted. It just requires you to be unlocked when someone’s trying every door on the street.
The Basics Are Still the Basics — Do Them
Nobody’s expecting you to hire a security team. But there are things that genuinely make a difference, and most of them are free or close to it.
Patching is not optional anymore. If your website runs on WordPress or any similar platform, out-of-date plugins are how most small business sites get compromised. Not through some brilliant attack — through the same hole that’s been documented for six months and that you just haven’t gotten around to fixing. Turn on automatic updates. Do it this week.
Your email is probably your biggest vulnerability. There are three DNS settings — SPF, DKIM, and DMARC — that prevent criminals from sending email that looks like it came from you. Your web host or IT person can usually set them up in under an hour. If you don’t know whether yours are configured, go to MXToolbox.com right now and check. It’s free and takes thirty seconds.
Multi-factor authentication. If your email, your ordering portal, your QuickBooks — whatever you use — offers two-factor authentication, turn it on. Yes, it’s mildly annoying. A compromised email account is considerably more annoying.
Your router has firmware. Most people set up their router when they moved in and never thought about it again. Log in and check when it last updated. If the answer is “never” or “I don’t know how,” call your ISP or a local IT person. It’s a one-time fix.
Tools You Can Actually Use
You don’t have to guess about your exposure. A few free tools will show you what attackers can see when they look at your business:
GRC ShieldsUP! at grc.com/shieldsup will probe your internet-facing address for open doors. Free, fast, no account required. Steve Gibson has been running it for decades and it’s still one of the most straightforward tools out there.
SSL Labs at ssllabs.com/ssltest checks your website’s encryption. Put your domain in and it’ll give you a letter grade. Anything below a B warrants a conversation with whoever manages your site.
Have I Been Pwned at haveibeenpwned.com tells you if your email addresses have turned up in known data breaches. If they have, change those passwords everywhere they were used.
SecurityHeaders.com scans your website for missing security configurations. It’ll show you exactly what’s wrong and explain why it matters.
Shodan.io lets you search your business’s IP address and see what’s publicly visible. If you find open remote desktop or database ports, that’s urgent.
None of these require technical expertise to run. They just require thirty minutes and the willingness to look.
One More Thing Worth Saying
Anthropic was careful about how they released Mythos — limiting access to a small group of companies specifically so defenders could get ahead of attackers before similar capabilities spread more widely. grc That window won’t stay open forever. The time between a vulnerability being discovered and being actively exploited is shrinking, and security teams — and businesses — need to operate faster than they used to. cloudsecurityalliance
You’re not going to stop a nation-state attacker. Nobody expects you to. But the people scanning small business websites for easy targets aren’t nation-states — they’re running automated tools looking for the path of least resistance. Good locks don’t stop everyone. They stop the people trying every door until they find one that opens.
Your customers trust you with their homes and their businesses. That trust includes how you handle your end of the connection. This stuff isn’t glamorous, and it doesn’t take long. But it does take actually doing it.
The Cloud Security Alliance’s full briefing is at labs.cloudsecurityalliance.org/mythos-ciso. Steve Gibson’s deep technical breakdown is in Security Now! episodes 1074 and 1075 at grc.com.