Small print.
Wide open.

Table of Contents

improve AI safety, they also subject us to compliance with evolving industry practices, laws and regulations, and 
increased  risks  related  to  the  processing  of  sensitive  data,  such  as  increased  risks  of  harm  or  litigation  if  we 
experience a security incident or unauthorized access to or processing of data. Further, laws and regulations not 
originally  enacted  to  address  AI  safety  are  being  applied  to  AI  safety  and  may  be  increasingly  interpreted  or 
enforced in ways that are inconsistent, unclear, novel, or subject to significant regulatory discretion. Any actual 
or perceived failure to comply with AI safety requirements or our processing of personal or sensitive data for AI 
safety, or any actual or perceived security incident involving such data, could result in investigations, litigation, 
fines,  penalties,  or  other  liability;  require  us  to  change  our  policies  or  practices;  reduce  customer  demand  or 
harm our reputation; require us to make public disclosures that could expose us to reputational and legal risks; 
and otherwise adversely affect our business, financial condition, and results of operations.

Any security breaches or other incidents, including those that affect our networks, systems, or 
data,  or  the  networks,  systems,  or  data  of  our  service  providers,  suppliers,  or  customers, 
could adversely affect our business, financial condition, and results of operations.

We  store,  handle,  and  otherwise  process  confidential,  proprietary,  and  personal  information,  and  our 
customers use our models, platform, and applications to process similarly sensitive information. We experience 
security risks, unintended exposure of or access to data, cyberattacks, and other attempts to gain unauthorized 
access to our information, sites, networks, systems, models, platform, and applications. These have resulted in, 
and may in the future result in, breaches of our security measures or those of our third-party service providers; 
unauthorized  access  to  our  sites,  networks,  systems,  and  accounts;  unauthorized  access  to,  and 
misappropriation  of,  personal,  confidential,  or  proprietary  information  belonging  to  us,  our  customers,  or 
others; viruses, worms, spyware, or other malware being served from our models, platform, and applications, 
networks, or systems; deletion or modification of content; the display of unauthorized content on our models, 
platform, and applications; interruption, disruption, or malfunction of operations; and other risks. 

We  have  in  the  past  faced  and  in  the  future  may  face  risks  of  phishing  schemes  and  other  cyberattacks, 
including  by  nation-states  and  state-sponsored  actors,  that  continue  to  evolve  in  sophistication  and  volume, 
and  may  inherently  be  difficult  to  detect.  Our  proprietary  model  weights,  corporate  and  financial  data,  and 
other  core  intellectual  property  represent  particularly  high-value  targets  for  state-sponsored  espionage  and 
theft, and security researchers have identified frontier AI companies as priority targets for non-U.S. intelligence 
services. The efforts of such state-sponsored actors to target us will likely increase over time, especially as we 
develop  models  with  next-generation  capabilities,  and  they  may  specifically  target  models  which  have  not,  or 
have  not  yet,  been  released  to  the  general  public.  For  example,  in  light  of  its  advanced  cyber  vulnerability 
discovery capabilities, state-sponsored actors may conduct cyberattacks specifically targeting Mythos. 

Our security capabilities continue to evolve, and certain aspects of our security program may not be sufficient to 
fully address the most sophisticated malicious actors, including well-resourced nation-state or state-sponsored 
groups,  especially  as  those  groups  develop  or  obtain  more  powerful  technology,  which  may  include  AI 
technology with offensive capabilities similar to those displayed by Mythos. While we are actively investing in 
and  enhancing  our  security  infrastructure  and  controls,  we  have  operated  in  the  past,  and  may  in  the  future 
operate,  for  periods  of  time  with  known  limitations  or  gaps  in  our  defenses  as  we  continue  to  mature  our 
security posture, and no information security program can be expected to prevent all possible incidents. There 
can be no assurances that we will be able to prevent or adequately detect and defend against all cyberattacks or 
other  cybersecurity  incidents  affecting  our  systems,  including  incidents  caused  by  nation-state  and  state-
sponsored  actors.  An  unauthorized  exfiltration  of  our  model  weights  could  enable  adversaries  to  bypass 
significant  research  investment,  eliminate  key  competitive  advantages,  and  potentially  raise  national  security 
concerns  if  such  technology  is  acquired  by  malicious  actors.  Further,  if  our  model  weights  were  obtained  by 
unauthorized  actors,  such  actors  may  be  able  to  deploy  such  models  outside  of  our  usage  policies,  safety 
mechanisms, or monitoring frameworks, which could enable harmful or misuse scenarios that our safeguards 
are designed to prevent and could subject us to regulatory, reputational, or public scrutiny for having developed 
such capabilities.

We  have  faced  and  expect  to  face  insider  threat  risks  and  vulnerabilities  related  to  hiring  processes,  identity 
verification,  remote  work  environments,  and  compromised  devices  that  could  enable  unauthorized  access  to 
sensitive systems or information. We have been and expect that we will continue to be targeted by individuals 
seeking employment under false identities, or with ulterior or malicious motives for seeking employment with 
us and the third parties on which we rely. We also face the risk that employees, contractors, or other personnel 

88