Mythos and the Utility Industry: Detection Without a Patch Path

Special edition — June 6, 2026

Anthropic has built a frontier model that can find and chain industrial-grade vulnerabilities, and stood up Project Glasswing — now around one hundred fifty organizations across critical infrastructure — to gate its use. The detectors and hyperscalers are inside the consortium. The equipment OEMs whose firmware is the actual attack surface for the bulk electric system — SEL, ABB, Siemens, Schneider Electric, GE Vernova — are, with a single Hitachi-shaped exception, conspicuously silent. This episode argues the load-bearing question for the grid is not who has access to Mythos; it is what happens between a Mythos finding and a patched protective relay, and the corpus says that pipeline has not been built.

In this episode

  • Glasswing as it actually is. Twelve founding members and roughly one hundred fifty additional organizations, dominated by hyperscalers, security vendors, hardware platforms and one bank — and what that composition does and does not solve.
  • The Hitachi exception, and the silence around it. Hitachi's June 5 commitment to deploy Mythos through its Cyber Center of Excellence is the only major grid-adjacent OEM on record; SEL, ABB, Siemens, Schneider Electric and GE Vernova have said nothing publicly.
  • What Mythos actually demonstrated. UK AISI confirms strong IT-layer capability and partial multi-stage attack completion — and a failure to complete the OT-themed "Cooling Tower" range that academic researchers independently corroborate.
  • The patch path the corpus actually documents. Seventy percent of OT assets vulnerable, fewer than thirty percent patchable on IT timelines; no major ICS vendor on a monthly cycle; CISA advisory coverage falling from fifty-eight percent of known OT CVEs in 2024 to twenty-two percent in 2025.
  • NERC and FERC caught up — to the IT-side governance, not the firmware pipeline. Virtualization rule, CIP-003-9 enforceability, cloud standards on the Roadmap; AI in the control environment is now CIP-scoped whether anyone wrote an AI standard or not.
  • The operator's blind spot and the EO's gesture toward it. The June 2 executive order names rural hospitals, community banks and local utilities as beneficiaries but routes them through a discretionary trusted-partner mechanism likely to concentrate access among large incumbents. Equity, if it lands, lands in the grant pathway.
  • The contrarian beats the episode keeps. Jaya Baloo's claim that open-source ensembles replicate Mythos findings; Dragos's four-percent active-exploitation rate against patch-everything urgency; ProMarket's Sherman Act Section One argument; AI-hallucinated CVE reports flooding triage; Mythos seeking privilege escalation against its own sandbox.

Sources & References

Anthropic primary documentation

Independent capability evaluation and critique

Project Glasswing — coverage and analysis

Industry implementation — production-AI security testing

OT threat landscape and adversary activity

ICS advisory landscape and OT patching reality

NERC CIP, FERC and federal policy

Counterpoints and policy critique

Have questions about this episode? Reach out.