Bruce Schneier Warns: Anthropic's Mythos Is Just the Beginning—AI Will Find Loopholes Everywhere

Let's start with what Anthropic is actually doing. Mythos Preview can find software vulnerabilities at scale—Mozilla used it to identify 271 bugs in Firefox, all of which have now been patched. OpenAI's GPT-5.5 and other open-source models can do similar things. The capability is real, and it's spreading.

This creates a short-term dilemma: defenders will patch vulnerabilities faster (good), but attackers will find them faster too (bad). Over time, as patching improves, defenders win—AI-enhanced defenders will eventually outpace AI-enhanced attackers. That's the optimistic story.

Schneier's real insight is this: "The same searching, pattern-matching and reasoning capabilities that make these models so good at analyzing software almost certainly apply to similar systems."

Take the tax code. It's not binary code, but it is code—a series of algorithms with inputs, outputs, and rules. And like software, it has vulnerabilities. We call them loopholes.

Here's what's probably happening right now: The largest investment banks have fed their AI systems the entire US tax code (or the UK's, or Japan's). They're asking it: find all the money-saving strategies you can. How many loopholes will it find? Ten? One hundred? One thousand?

Weirdly, we actually have historical precedent. The Double Dutch Irish Sandwich is a tax structure that exploited loopholes across three tax jurisdictions simultaneously. It took brilliant tax attorneys decades to develop. An AI like Mythos could find the equivalent of 100 Double Dutch Irish Sandwiches in an afternoon.

It's not just taxes. Environmental regulations, food safety rules, labor law, financial services rules—any complex system of rules and strategies becomes a target for AI probing.

Scouts of regulations exist for specific reasons (environmental protection, worker safety, financial stability). But they're also complex, and complex systems have loopholes. Once Mythos-level AI finds those loopholes, the social consequences are enormous:

1. Corporations exploit them: Environmental regulations get circumvented. Financial rules get gamed. Worker protections erode.
2. Patching is slow: Governments don't move at tech speed. The carried interest loophole has existed in US tax code for decades despite multiple attempts to close it.
3. Lobbyists delay fixes: By the time a loophole is discovered, the industry has a financial incentive to keep it open. Lawyers and lobbyists deploy to block legislative patches.

This is the real vulnerability landscape we're entering.

Mythos didn't cause this—it just made it obvious. The capability is spreading. GPT-5.5 is already available to anyone. Smaller, open-source models can replicate Mythos's results. Within months, every hedge fund and every large corporation will have access to AI that can find regulatory loopholes at scale.

The industrial revolution gave humans the ability to consume calories (energy) outside their bodies at scale. The AI revolution is giving them the ability to perform cognitive tasks outside their bodies at scale—including the cognitive task of finding loopholes.

Our systems—legal, regulatory, financial—were designed for human-scale cognition. They move slowly. They rely on complexity as a defense ("nobody understands the tax code"). AI breaks that defense instantly.

Schneier doesn't propose one, and neither does any policymaker we've heard from. The honest answer: we don't have one yet.

In software, the answer was "build better patches and deploy them faster." That works because software vendors move at digital speed. But you can't move regulatory policy at digital speed without destroying democratic process entirely.

What we need to do: Recognize that complexity is no longer a security mechanism. Regulations need to be simpler, more transparent, and faster to amend. Tax code needs a reset. Financial rules need modernization. But doing this requires political will to close loopholes before AI finds them—not after.

The alternative is a slow-motion race where every loophole AI finds gets exploited for years before regulators patch it. That's already the world we live in. Mythos just accelerates it.

If you're an executive: Your competitors are already running Mythos or its equivalents on regulatory frameworks to find loopholes. If you're not, you're falling behind. But understand that the loopholes you find will be publicized, copied, and eventually closed—possibly with retroactive penalties.

If you're a regulator or policymaker: You have a narrow window to simplify and clarify regulations before frontier AI finds all the loopholes. After that window, you're playing defense for years.

If you're just using Claude: Mythos doesn't change how the product works for you. But it does mean your government and your regulators are about to have a very hard time. Expect chaos.

Bruce Schneier: How dangerous is Anthropic's Mythos AI? - The Guardian | Original essay exploring the long-term implications of advanced vulnerability-finding AI.