In late March, rumors of a new Anthropic Claude AI model called Mythos triggered a sudden sell-off in cybersecurity stocks. Panic mounted weeks later when the company confirmed that the software was too dangerous for standard public release. Anthropic warned that Mythos could independently map out an organization’s entire digital infrastructure and exploit invisible security flaws. Even worse, the model could mount cyber attacks itself, sending shock waves across the global insurance sector.

To contain this dire threat, Anthropic subsequently halted the public launch of Mythos and confined the unsecured system to a private, closed-door alliance of a dozen defense agencies and elite tech firms. Known as Project Glasswing, the coalition was tasked with patching the model’s vulnerabilities to prevent a catastrophic breach. On June 9, the emergency work concluded, and Anthropic released a heavily secured version of the AI model to the commercial market under the name Claude Fable 5.

However, the rollout was short-lived. In a dramatic intervention, the U.S. Commerce Department immediately shut down commercial access to Claude Fable 5, citing severe ongoing cybersecurity concerns. Yet rather than killing the project, industry insiders argue the government’s aggressive crackdown merely ensures that Anthropic and Project Glasswing will be heavily motivated now to implement even stricter security compliance protocols to get the model back online.

(Editor’s Note: According to a June 12 statement from Anthropic, “The U.S. government, citing national security authorities, … issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.”

The Anthropic statement continued: “The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.”)

Related articles: Anthropic Releases Mythos-Like Model Without Cyber Capabilities; Anthropic Block Marks US Reversal, Warning to Silicon Valley

While this public version remains temporarily frozen, its unsecured twin, known as Mythos 5, remains locked away inside Project Glasswing to hunt down critical flaws before cybercriminals can exploit them. To assist the search, the alliance has ballooned to approximately 150 critical infrastructure providers across 15 countries, including global power grids, water networks and healthcare systems.

Despite the regulatory halt, the sheer existence of the technology remains a gut punch for underwriters who price cyber risk, the brokers who sell the coverage and the risk managers who buy this protection, upending their ability to rely on past data to predict future hacks. Annual insurer security questionnaires are no longer enough, as traditional security frameworks simply cannot keep pace with an AI adversary capable of finding a network vulnerability and building an exploit tool in seconds.

“Carriers relying on point-in-time cyber risk underwriting operate at a disadvantage because they cannot notify customers of specific vulnerabilities likely to lead to a claim.”

Joshua Motta, Coalition

Consequently, buyers now face a double-edged sword: they can use public AI to streamline their operations, but they must simultaneously defend their networks against lightning-fast attacks. If an insurer is incapable of reacting at the same warp speed, said Joshua Motta, CEO of Coalition, “It’s reasonable to believe this technology fundamentally increases both the potential frequency and severity of claims.”

He warned that advanced AI models “do not just find vulnerabilities; they turn those flaws into functional exploits that allow threat actors to conduct automated cyber attacks.”

Speed Bumps

To match the velocity of an AI-fueled adversary, the cyber insurance industry is transitioning to an active security partnership with corporate insureds. That’s the innovative model pioneered by Coalition, a technology firm that also operates as an insurance carrier.

Several industry participants maintain that to survive in an era where cyber threats strike in the blink of an eye, the relationship between insurance companies and business buyers must fundamentally change. By coupling coverage with continuous, automated scanning to catch vulnerabilities before hackers can exploit them, the partnering entities effectively battle code with code, creating a new global standard of corporate cyber resilience.

By constantly evaluating public Internet traffic across the globe, these modern insurers can spot emerging threats without charging clients extra fees for security reasons. This setup allows them to provide businesses with real-time alerts and instant mitigation before a minor glitch turns into a company-wide disaster.

Traditional insurance companies lack this level of technical depth and real-time analytics to actively interdict cyber events before they cause operational damage. Instead, legacy insurers rely on decades of historical actuarial data to calculate the odds of a future accident.

“Carriers relying on point-in-time cyber risk underwriting operate at a disadvantage because they cannot notify customers of specific vulnerabilities likely to lead to a claim,” said Motta. He channels the market’s current anxiety, emphasizing that the elevated exposures generated by malicious AI models make real-time visibility mandatory.

For example, if Coalition’s automated system detects an identity theft attempt or a compromised corporate email account, it can instantly kick the intruder out, kill the active session and force a password change. According to Motta, this level of defensive velocity has become a crucial corporate asset. “During the first quarter, our automated ecosystem averaged a response time of just 694 milliseconds per event,” he asserted.

To power this rapid-response engine, Coalition actively tracks threat actors through a global network of “honeypots”—decoy computer servers that mimic real business infrastructure. By analyzing how hackers attack the fake networks, threat intelligence teams can map criminal strategies in real time and proactively push defensive patches across their entire insured portfolio before a live breach occurs.

The stakes could not be higher. The federal government’s unprecedented intervention to freeze Claude Fable 5 underscores a terrifying reality: autonomous AI models capable of collapsing the timeline between vulnerability discovery and exploitation into milliseconds pose a systemic risk to cyber insurers. If an automated adversary exploits a single software flaw across thousands of businesses simultaneously, the resulting wave of concurrent claims could easily exhaust traditional carrier capital.

“If a major cloud provider or a core piece of Internet software suffers an automated AI attack, it could trigger a catastrophic aggregation event,” said Mario Paez, National Cyber Risk Leader at Marsh McLennan Agency (MMA). The Commerce Department’s freeze on Fable 5 suggests that regulators are direly concerned over such a possibility. “Traditional underwriting reliant on historical data cannot accurately calculate a risk environment where zero-days are weaponized at scale in seconds,” Paez noted.

“A corporate AI agent can backfire and target its own network, meaning defenders must be incredibly vigilant about privilege controls.”

Mohibi Hussain, Beazley Security

Other industry leaders maintain that such speed changes how the industry must respond. On the front lines of these unfolding threats, Mohibi Hussain, Director of Global Advisory at Beazley Security, warns that the technical domain has fundamentally changed. “Autonomous AI models can instantly expose every single flaw in an organization’s security posture,” Hussain explained. “A corporate AI agent can backfire and target its own network, meaning defenders must be incredibly vigilant about privilege controls.”

Melissa Carmichael, Head of Cyber Underwriting for the U.S. at Beazley, shares her colleague’s urgency. “The true danger for insurers is the risk of systemic loss,” she said. “The ability of an automated model to execute exploits at mass scale and with extreme speed means the industry can no longer rely on annual applications and questionnaires. Cyber underwriting must become a continuous process rather than a point-in-time exercise. We must transition to an ecosystem of constant monitoring to ensure an insured’s security posture remains resilient.”

According to John Farley, Managing Director and U.S. Cyber Practice Leader at Gallagher, advanced AI models are forcing corporate security teams to overhaul their organization’s defenses and cyber insurers to re-evaluate their traditional underwriting. “Carriers are shifting their core philosophy from ‘trust but verify once a year’ to ‘never trust, always verify,'” Farley stated. “This directly mirrors the zero-trust architecture that CISOs use to secure corporate networks. If threat actors can uncover software flaws at a volume traditional methods could never match and simultaneously exploit them in near real-time, patch management to remediate exposures the second they are discovered is absolute table stakes. The luxury of time is entirely gone.”

“The ability of an automated model to execute exploits at mass scale and with extreme speed means the industry can no longer rely on annual applications and questionnaires. Cyber underwriting must become a continuous process rather than a point-in-time exercise.”

Melissa Carmichael, Beazley

Sharing the Burden

Other industry participants view the capabilities demonstrated by Claude Fable 5 as a concerning but ultimately manageable challenge for the cyber insurance sector. Jürgen Reinhart, Global Chief Underwriter Cyber at Munich Re, views the underlying technology as the continuation of a longstanding technical trend. “It increases the speed and scale of cyber attacks in general, but it is not a sudden disruption that robs me of sleep,” he said.

According to Reinhart, the model’s primary impact is economic rather than technological, effectively lowering the barrier to entry for cybercrime once these systems inevitably become widely available. While sophisticated threat actors already possess deep resources, the real transformation occurs at the lower end of the spectrum. He explained that automated AI tools arm inexperienced bad actors with capabilities they could never build on their own, dramatically scaling up threat volumes and exposing defenseless small businesses.

Had Claude Fable 5 continued operating at scale without federal intervention, human IT teams could not have patched software fast enough to keep pace with the sheer volume of newly discovered vulnerabilities. Assuming the likely re-release of the AI model, Reinhart warned that organizations will be buried under a continuous backlog of security flaws, forcing them to triage threats rather than resolve them. “This systemic delay will inevitably drive up the frequency of network breaches and insurance losses, particularly for small and mid-market businesses,” he said. “To absorb these mounting losses, insurers will have no choice but to raise premiums.”

“It increases the speed and scale of cyber attacks in general, but it is not a sudden disruption that robs me of sleep.”

Jürgen Reinhart, Munich Re

While the brief availability of the commercial AI model forced corporate vulnerabilities into the open and accelerated the need for enhanced corporate defense, insurers remain deeply uneasy about systemic exposures when access is inevitably restored. Beneath the surface calm, carriers are “terrified of a widespread vulnerability impacting an entire insurance portfolio simultaneously,” said Robert Barberi, Managing Director of Willis Cyber at WTW.

There is a growing mutual interest among carriers and clients to engage in robust information sharing. “We’re increasingly seeing tech-forward carriers proactively reach out to clients mid-term to draw awareness to specific, active exposures,” Barberi said. This practice puts real-time vulnerability monitoring directly into the hands of clients, perfectly aligning underwriting with live risk mitigation. “Underwriting must shift away from static questionnaires to analyzing how a company behaves structurally,” Barberi noted. “While continuous monitoring is rapidly becoming mandatory for large enterprises, insurers must increasingly deliver it as a built-in service for smaller companies.”

From a coverage standpoint, the immediate good news for buyers is that the brief launch and subsequent shutdown have not caused carriers to introduce broad AI exclusions on standard cyber policies. If a cyber attack occurs and is otherwise covered under a policy, Barberi clarified that it should not matter whether it was executed via an AI-supported exploit chain or a traditional human method.

However, he added that the rise of autonomous AI models raises the question of whether a standard cyber policy is truly fit for the future risk landscape, particularly regarding non-malicious incidents like AI hallucinations. If an enterprise AI model underperforms and causes a massive financial loss or data disruption without an actual external cyber attack, that operational failure remains entirely uninsurable under a standard cyber form.

To bridge these gaps, the insurance market is rolling out creative new coverage options and faster payout methods to handle modern risks. “We are seeing specific add-ons like deepfake response coverage,” Carmichael noted, explaining that these specialized endorsements absorb the expensive forensic investigations and public relations fixes needed after a synthetic media scam.

To avoid the protracted legal fights that traditionally stall business interruption claims, underwriters are also increasingly deploying parametric solutions, MMA’s Paez pointed out. These policies use simple, objective triggers, such as the exact number of hours a major cloud provider stays offline. If the outage threshold is breached, the solution pays out a predetermined cash amount immediately, giving an organization needed liquidity while its technical team restores the network.

The New Reality

The arrival and subsequent federal freezing of Mythos-class AI will likely accelerate a sharp market correction that inevitably splits the industry in two. “We are quickly moving toward a market of the ‘haves and the have-nots,'” Paez said. “The carriers that are hands-on, proactive, and insist on continuous inside-out monitoring will successfully navigate this shift. Conversely, I have serious concerns about legacy carriers that manage massive portfolios while relying strictly on passive, third-party, outside-in scans,” he explained.

For corporate buyers, maintaining robust security is no longer an operational task that organizations delegate to an isolated IT department; it’s fast becoming a prerequisite to obtaining any coverage at all. To secure a policy, businesses must prove they have strong multi-factor authentication, active system monitoring and audited response plans for systemic emergencies. Moving forward, companies must operate at the same velocity as the automated models attempting to breach their perimeters. By partnering with tech-forward insurers that provide continuous network visibility and instant incident response, commercial enterprises can successfully shield themselves from automated exploits.

While the insurance take-up rate remains very high among large corporate clients, interviewees contended the regulatory shock waves surrounding Mythos-class threats will drive up demand across the smaller commercial segment. “Those business owners realize they can no longer defend their enterprises without an active insurance partner,” said Carmichael.

Ultimately, this realization will lift security standards across all businesses, enforcing a highly disciplined approach to pricing and managing digital liabilities.

The broader cyber insurance market, however, remains structurally sound. As Munich Re’s Jürgen Reinhart put it, “This development is not a market disruptor; on the contrary, the insurance industry is structured to assess, price and absorb these changing risks. As more companies seek coverage, we expect increased premium volume to drive industry profitability while simultaneously building greater systemic resilience across the broader economy.”

Featured image: AI-generated (ChatGPT)