Anthropic's "Mythos" Leak Sparks Cybersecurity Selloff: Repricing AI Risk or Market Overreaction?

Last Friday's selloff in cybersecurity stocks was not driven by earnings or macro data, but by leaked materials tied to Anthropic's unreleased "Claude Mythos" model. What the market repriced was not merely the existence of a stronger system, but the possibility that frontier AI could push code analysis, vulnerability discovery and parts of the offensive workflow forward faster than the defensive stack can adapt.

Start with what happened. According to Fortune, a misconfigured CMS cache exposed unpublished Anthropic site materials that referenced a model called "Claude Mythos" and a higher capability tier named "Capybara" The most consequential detail was not the branding. It was the leaked language describing a "step change" in coding, reasoning and cybersecurity capabilities, alongside explicit concern about cyber misuse.

Palo Alto Networks fell about 6.1% on March 27, while CrowdStrike dropped roughly 5.2% and Zscaler slid around 5.8%. Fortinet also sold off sharply, leaving several major cybersecurity names among the S&P 500's biggest decliners that day. The market treated the leak not as an isolated company-specific headline, but as a broader signal for the sector.

Next, what is Mythos? At this stage it is not a fully public, broadly commercialized product with transparent specifications. It appears to be an unreleased frontier model whose existence became visible earlier than Anthropic intended. In Fortune's follow-up reporting, Capybara seemed to describe a class of system above Anthropic's current flagship tier, while Anthropic confirmed that a stronger model is in early-access testing and that the exposure resulted from human error.

What unsettled investors was the framing. The leaked materials did not read like a routine product tease. They stressed near-term cyber risk and suggested that some organizations should see the model early so defenders can prepare. That framing implied a more immediate concern: the automation, scale and cost-efficiency of offensive activity may arrive sooner than many had expected.

Cybersecurity stocks fell sharply in part because investors began to worry that AI-enabled offensive capability may be accelerating faster than the defensive stack can keep up. For years, security vendors have argued that while threats evolve continuously, telemetry, automation, response speed and platform breadth allow defenders to stay competitive. The Mythos leak disrupted that narrative. If advanced models can materially improve code understanding, exploit analysis and segments of the offensive chain, the natural question becomes whether attacker capability could outpace the speed at which defensive products can be commercialized.

That concern quickly translated into a valuation issue. As MarketWatch argued, the issue is not simply whether Anthropic will compete directly with security vendors. The deeper concern is that AI may reshape how cybersecurity value is created, distributed and ultimately captured. For richly valued software names, that kind of uncertainty alone can trigger multiple compression.

At the same time, attention shifted toward potential value-chain migration. Investors are no longer sure that the future profit pool of cyber defense will stay with standalone security vendors. If model providers and cloud platforms embed code review, anomaly detection, automated remediation and attack simulation deeper into infrastructure, some capabilities now sold as distinct security products could become more platform-native over time. That does not mean incumbents immediately lose relevance. It does mean the market has to rethink where durable pricing power ultimately resides.

Just as important, the leak made AI-assisted cyber risk feel operational rather than theoretical. Axios reported that policy and AI circles viewed Mythos as worrying not because it writes prettier code, but because advanced agentic systems may enable high-precision, large-scale offensive activity more easily. The concern extends beyond external actors. It also includes internal misuse, from shadow AI to poorly governed agents connected to sensitive systems.

Still, market opinion is split. The bearish camp argues that Mythos exposed a structural problem: AI is moving from being a tool for human attackers toward becoming a partial substitute for human offensive labor. If that is right, enterprises may need to rebuild code security, identity controls, permissions, internal AI governance and response architecture faster than expected, while traditional product lines face pressure on positioning and pace.

The more constructive camp sees an overreaction. Barron's and MarketWatch both laid out the counterargument: stronger offensive AI may increase, not reduce, the need for security spending. In that reading, the leak does not destroy the cyber thesis. It accelerates a shift toward AI-native defense, identity security, code protection, agent governance and response automation.

What comes next

What comes next may determine whether last Friday's selloff was simply a sharp headline-driven reaction or the beginning of a broader reset in cybersecurity valuations. The next earnings cycle will be an important test. Investors are unlikely to be satisfied with general warnings about AI risk alone; they will want management teams to explain, in practical terms, how rising agentic-AI threats translate into product roadmaps, customer demand and budget capture. If executives can describe the danger but cannot show a clear monetization path, pressure on valuations may linger.

Just as important is where enterprise security spending actually ends up. If budgets continue to move toward identity, code security, endpoint response and AI governance, independent cybersecurity vendors could still prove to be key beneficiaries. But if more defensive capability is absorbed into cloud infrastructure and model platforms, the market is likely to keep assigning more value to the companies higher up the stack. The direction of that spending will say a great deal about how the sector differentiates from here.

Another issue is execution speed. The market will be watching to see whether frontier AI developers or incumbent cyber vendors are better at turning defensive automation into real, deployable products. My view is that the recent drop looks like an event-driven repricing in the short run, but also the start of a more meaningful sorting process over the medium term. Near-term volatility may not be over, yet the broader case for cybersecurity spending remains intact. Enterprises facing stronger AI-enabled attacks are unlikely to spend less on defense. The more important question is which companies are positioned to capture that spending.