Existing cyber cat bonds structured to withstand Claude Mythos turbulence: Man Group

As Anthropic’s advanced cybersecurity AI model, Claude Mythos, continues to generate significant noise across the cyber sector, investment manager Man Group notes that the per-occurrence structures and high attachment points of existing cyber catastrophe bonds should provide meaningful insulation from future turbulence, for when more advanced AI models eventually become widely available.

In early April, Anthropic announced the successor to its Claude Opus model: Mythos Preview. While a general-purpose language model, Mythos has demonstrated capabilities in computer security, including autonomously discovering and exploiting zero-day vulnerabilities, as well as reverse-engineering exploits on closed-source software.

“Of concern is not that Mythos is discovering vulnerabilities that could not be discovered by skilled researchers, rather, it allows the search for and application of vulnerabilities to be done at scale, and to potentially put such skills in the hands of less skilled, but malicious actors,” Man Group said.

In response, Anthropic launched Project Glasswing, an initiative bringing together users and authors of some of the most critical software, such as Apple, Google, Linux Foundation, and Cisco, in order to employ Mythos Preview for defensive security.

Man Group noted that Anthropic eventually intends to deploy Mythos-class models with built-in safeguards that detect and block nefarious use. The firm also noted that as part of Anthropic’s evaluation of Mythos, thousands of highly critical vulnerabilities were also identified.

“The concern though is that sooner or later, malicious actors will get their hands on Mythos Preview or a competitor of similar abilities and exploit these vulnerabilities at scale. So, what are the implications for cyber security, cyber insurance, and cyber catastrophe (cat) bonds,” Man Group said.

Adding: “So far, we have observed a benign insurance response, partly, we think, because there haven’t been any severe events yet, but it would be naïve to assume that these capabilities do not elevate the cyber threat level.”

Of the six outstanding 144A cyber catastrophe bond deals, Man Group highlighted that five are per occurrence deals.

“The decision of what constitutes a single occurrence is sometimes delegated to the sponsor rather than effected through a precise legal definition. The latter would be difficult to codify,” the firm said.

Adding: “The cyber linkage of events is potentially more difficult to define, given potentially multiple steps in an attack. In any case, per occurrence deals and high attachment points mean that we need to see a single event causing insured loss which is an order of magnitude greater than what we have seen to date. As an aside, we note that cat bond risk modellers may not necessarily aggregate losses in the same way that the insured does.”

Man Group went on to note that the re/insurance and ILS industry will still need to grapple with two fundamental questions.

“First, if an AI agent simultaneously attacks multiple institutions, insurers must determine if that constitutes a single event. Whether the 11 September 2001 attacks on the World Trade Center constituted one or two events was heavily litigated, and defining the cyber linkage of events is potentially more difficult. Second, as corporates integrate AI into their processes, the market must consider whether AI outages warrant sub-limits as is already the case for cloud service outages,” the firm explained.

Man Group also emphasises that AI technology may become a more integral part of corporate processes. Given the relatively small number of vendors, the firm argues a systemic supply chain dependence could emerge, similar to current exposures to cloud service outages

“To date, the cat bond market response to the Mythos Preview has been benign. Prices are stable and there has been no selling pressure. It is quite possible that investors are becoming more entrenched in their views. Some will consider that Mythos affects only a few causes of loss; needs to get into the wild before Glasswing and other remediation gets there first; and either the vulnerabilities are orders of magnitude more severe than what we have seen to date, or an army of attacks is regarded as a single event. Others will see Mythos as justification for why they are keeping away from cyber as a peril,” Man Group said.

Furthermore, the investment manager also observes that one key reason why cyber risk has been attractively priced is due an overall lack of very severe event history in a rapidly evolving landscape and, as such, cyber risk models have appeared nascent.

“The emergence of Mythos potentially represents a step change in threat discovery, exploit, and remediation speeds. Effectively, the ‘maturity-clock’ of the risk models is being reset. The end result is likely to be a stronger global infrastructure, but there will likely be a risk of undesirable attacks along the way. We believe that the seniority and terms of existing cat bonds means that they can withstand the coming turbulence,” the firm added.

Concluding: “When models like Mythos Preview eventually become widely available, good software practices and staff trained against social engineering will remain the best defence.

“For now, we believe the per-occurrence structure and high attachment points of existing cat bonds are likely to provide meaningful insulation from the turbulence ahead.”