
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Expert article
This article is for owners, CEOs and directors who want to understand artificial intelligence well enough to discuss it with suppliers and their own team. We explain without jargon what AI is, which technologies lie behind it, where it really helps in a mid-sized company and where it falls short. At the end we bring together the regulations that already apply.

An ordinary program works according to rules someone has written down: if an invoice amount exceeds PLN 10,000, send it to the director. An AI-based program is given thousands of examples instead of rules and finds the patterns in them by itself. For example, you show it three years of sales history, and it forecasts demand for the coming months.
This difference explains both the strength and the weakness of AI. A program that learns from examples can handle situations nobody foresaw in the rules, such as an email written in an unusual way. But its output is probable rather than certain – and it is sometimes wrong, even when it sounds convincing.
There is one more thing that matters for the management board. AI is not a single product but a family of technologies. When a supplier says “we have AI”, it is worth asking which technology it is, what data it learns from and who checks its output.
A dozen or so terms come up in conversations about AI, but most of them describe a handful of technologies that often work together. The table below brings them together in one place, with an example from the everyday life of a mid-sized company.
Older methods, such as rule-based expert systems or fuzzy logic, which allows intermediate values instead of “yes or no”, still run in many devices and programs. Today, however, new projects rarely start with them.
| Technology | What it does | Example in a company |
|---|---|---|
| Machine learning | Finds patterns in numerical data and uses them to predict or classify | Sales forecasts, detecting unusual transactions, assessing the risk of late payment |
| Neural networks and deep learning | Multi-layered models loosely modelled on the brain, good with images, sound and language | The engine behind most of the modern applications in this overview |
| Natural language processing | Understands and organises written or spoken text | Recognising the type of matter in a customer email, turning a call recording into text |
| Computer vision | Recognises objects and reads data from images | Quality control on a production line, reading data from a scanned document |
| Generative models | Create new text, images or sound based on an instruction | A draft quote, a contract summary, an answer to a question about company procedures |
| AI agents | Carry out several steps on their own, using company systems | An agent that takes an order from an email, checks stock levels and prepares a confirmation |

The most attention today goes to large language models, which power ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Mistral’s models. In Microsoft 365 they are used through the Microsoft Copilot assistant. Put simply, such a model predicts which words should come next, based on the huge amount of text it was trained on.
That explains its strengths: it writes fluently, summarises, translates, organises notes and answers questions about documents. It also explains a weakness known as hallucinations. The model can cite a regulation or a figure that does not exist, because it “sounds plausible”, not because it has checked it.
Connecting the model to company documents, so that it answers on their basis and cites the source, reduces the risk of hallucinations. It does not eliminate it, though. That is why a person must have the final say on documents for customers, public authorities and the accounts.
Take a hypothetical distribution company with 120 employees. AI has the best chance of making a difference where people write, read and retype every day: in quotes, customer emails, contracts and reports. Less obvious, but also valuable, are forecasts based on data the company already collects.
Below are the areas where mid-sized companies most often start. We describe detailed examples from ten industries in a separate guide.

AI creates value for a company not when it impresses at a demo, but when it shortens specific work for specific people every day.
According to Eurostat, in 2025 about 20% of enterprises in the European Union with at least 10 employees used AI technologies. In Poland the figure was about 8%, one of the lowest in the EU. The data covers companies that themselves report using AI, so it does not include employees using personal tools without the company’s knowledge.
For a mid-sized company the conclusion is calm rather than alarming. Most Polish competitors are only at the beginning, so there is no need to catch up in a hurry. Even so, it is worth testing one or two processes now, because the experience gained on a small project will help with the next ones.
An honest conversation about AI starts with its limitations. None of them rules out an implementation, but each requires a specific answer in the project. Before you decide, go through the list below together with your supplier:
The AI Act, the EU regulation on artificial intelligence, is coming into force in stages. Some obligations already apply; others were postponed by the Digital Omnibus package of amendments in 2026. We have collected the key dates for a mid-sized company below, and describe the full timeline in our article on rules for using AI.
The penalties are high: up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for other infringements. For small and medium-sized enterprises, the lower of the two amounts applies. In Poland the rules are enforced by KRiBSI under the Act on Artificial Intelligence Systems of 3 July 2026.
The best start is not a technology programme but a list of processes in which people lose the most time or make the most mistakes. From it you choose one, measure what it costs today and test AI within a limited scope. If the company works on Microsoft 365, the first tool is often Microsoft Copilot, because it works in the programs people already use.
At the same time, set some simple rules: which tools may be used, what data must never be pasted into them and who checks the output. We describe costs, a plan for the first few weeks and questions to ask suppliers in detail in the separate guides linked below.
Related topics in the knowledge base
FAQ
The questions management boards ask most often in their first conversation about AI.
About this page
Sources
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamTogether we will go through the processes where your team loses the most time and identify one worth starting with, along with rules for using AI safely.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.