Travelers Institute highlights AI cybersecurity arms race

The Travelers Institute Risk & Resilience Podcast recently launched a special four-part cybersecurity series that examined the issues insurance organizations face as cyber threats continue to evolve.

The first episode, released as part of Cybersecurity Awareness Month each October, focused on one of the most consequential developments in the threat landscape: Artificial intelligence .

Travelers Institute President Joan Woodward hosted the series, which brought together Travelers cyber experts to explore how organizations can prepare for, prevent, mitigate and recover from cyber incidents.

In the first episode, Jesse Sugarman of the Travelers Institute, spoke with Lauren Winchester, head of Cyber Risk Services at Travelers, how increasingly powerful AI models are changing the speed and sophistication of vulnerability discovery, detection and patching for both defenders and attackers.

The discussion began with an overview of Project Glasswing , an initiative spearheaded by Anthropic with 50 initial partners to test the capabilities of its powerful Mythos AI model. Winchester said the testing confirmed that the model's cybersecurity capabilities are significant. Mythos can identify zero-day vulnerabilities — previously unknown weaknesses in software — and develop potential exploits for them.

"One partner mentioned finding 10x the number of vulnerabilities in their software code in their most recent release," Winchester said. Anthropic also used the model to examine open-source software and identified thousands of high- and critical-level vulnerabilities requiring patches.

The findings underscore AI's dual-use nature. While powerful models can help defenders identify weaknesses before attackers exploit them, their capabilities also raise concerns how those same tools could be used maliciously. Anthropic's answer is to place significant guardrails around its publicly available models, but Winchester noted that excessive restrictions can create challenges for cybersecurity professionals trying to use AI defensively.

Other AI developers are confronting similar issues. OpenAI has developed models with advanced offensive cybersecurity capabilities and restricted access to certain security and software-development organizations. Models are increasingly being evaluated through tests such as Exploit Gym, which measures how effectively they can discover vulnerabilities and potentially exploit them.