Aditya V Kashyap, AI and Innovation Leader, driving enterprise transformations through trusted strategy, governance and bold leadership.

getty

On August 1, 2012, Knight Capital Americas deployed a software update before the opening bell. The new code was installed on seven of the firm’s eight order-routing servers. On the eighth, an older dormant function remained active and began generating unintended trades when markets opened.

Over roughly 45 minutes, the system sent more than four million orders involving 154 stocks while processing only 212 incoming customer orders. The trades themselves were technically valid and passed existing system checks, but the deployment inconsistency produced catastrophic market behavior. Knight Capital lost approximately $460 million in a single morning, a blow from which the company never recovered as an independent firm.​ Nothing was technically wrong, but nothing was right.​

We treat risk as a quantity. Something to compute, hedge, model, attest to and report up. The premise underneath that posture is that the unknown can be bounded if we are rigorous enough. What if the premise itself is the exposure?

For most of modern history, the premise held. We assigned probabilities, built distributions and trusted that a disciplined model could fence in the world. The job of a risk manager was to turn the unpredictable into something a board could approve. That worked when systems were slow, and the boundaries between markets, technologies and behaviors stayed roughly where the models had drawn them.

That world is fading.

What is replacing it has a name. We are moving from a regime of risk to a regime of uncertainty. Risk is when the odds can be computed. Uncertainty is when they cannot. The distinction sounds philosophical until it shows up in a portfolio, a supply chain or an operating model.

Which brings us to Mythos.

Mythos, formally Claude Mythos Preview, is a new AI model announced by Anthropic in April 2026, designed to operate autonomously on long, multistep cybersecurity tasks. In testing described by Anthropic and partner organizations, the system identified thousands of previously unknown software vulnerabilities across major operating systems, browsers and open-source projects, including flaws that had persisted in mature codebases for years.

​What separates systems like Mythos from earlier automated security tools is their ability to reason across large codebases and connect relationships between components, dependencies and exploit paths with relatively limited human guidance. Anthropic and outside testers reported that the model could analyze complex software systems, identify subtle vulnerabilities and in some cases generate multistep exploits autonomously.​

It behaves less like a conventional tool and more like an unusually patient reader of large, complex systems that nobody has read in full for a very long time.

The conversation about Mythos has been almost entirely about capability. But Mythos did not create the fragility. It surfaced it.

Modern systems share more dependencies than any single team can hold. A faulty update from one vendor can ground airlines, freeze hospitals and stall payment systems on multiple continents in a morning. Many of the buffers that once prevented small problems from becoming major failures, including spare capacity, slack inventory and human review, no longer exist because organizations have optimized for efficiency. What remains is a tightly coupled machine in which small disturbances travel further and faster than our intuitions allow.

Call it comprehension debt. Like technical debt, it builds silently, compounds with every shortcut and becomes visible only when something forces a payment. Every deferred architectural decision and every dependency taken on faith sits on the balance sheet of what we operate but no longer fully understand. Knight Capital paid years of comprehension debt in 45 minutes. Most institutions are still accruing.

We are not managing systems we fully understand. We are managing systems we operate. Operation keeps something running. Understanding predicts how it behaves when conditions change. In more and more domains, control has been replaced by probability, and probability has been mistaken for comprehension.

Models will fail more often, in ways obvious in hindsight and invisible in the moment, and resilience becomes the premium. As a goal, that is right. But the way it is being implemented is becoming the next concentration risk. Institutions are buying the same playbooks from the same advisors, routing critical workloads through the same cloud providers and stress-testing against the same severe-but-plausible scenarios. The result is operational diversification that is not, in any meaningful sense, diverse. We are writing capital rules when the binding constraint has become dependency rules.

The temptation is to answer with governance rituals; the deeper work is intellectual. Stop asking whether your risk framework covers the newest threat. Start asking whether it still describes the world it was built to govern. Design for systems that can absorb a surprise, not systems that assume surprises can be enumerated. Treat comprehension debt the way good engineers treat technical debt: Pay it down on your terms, before the system collects on its own.

Seen this way, the conversation about Mythos is almost beside the point. The right question is why so many institutions are organized around a definition of risk that no longer fits the systems they run on. Every era of finance gets the symbol it deserves, and every era eventually learns the symbol was a symptom, not a cause. We are at a similar moment, and the symbol happens to be Mythos.

Systems can fail. They always could. What is new is not the possibility of failure, but the belief that failure can be fully anticipated by the same tools that produced the system. That belief is no longer harmless. It sits underneath nearly every model on a board's desk, and it is the assumption that the next decade is the least likely to forgive.

The real risk is not Mythos. The real risk is the model of risk we have inherited and applied without revision to a world that has already moved on. Until we update the lens, no defense against any single threat will be enough. We will keep solving last decade's problems with last decade's tools. And we will keep being surprised that the answers no longer fit the question.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?