Security stocks fell up to 21% on Anthropic launches; CrowdStrike has since gained 154%

01Four launches, four sizes of fall

Anthropic announced Claude Code Security on Friday 20 February, a “limited research preview” for Enterprise and Team customers that scans codebases for vulnerabilities and suggests patches for human review.¹ Over that session and the next, CrowdStrike closed 17.0% lower, Cloudflare 16.8%, Zscaler 15.2% and Okta 15.0%; the First Trust Nasdaq Cybersecurity ETF (CIBR) fell 7.0%. The iShares software fund (IGV) fell 5.9% over the same two sessions, 4.75% of it on Monday 23 February, so the second day was a software day as much as a security one.²⁰ Akamai’s 14.1% fall on 20 February came the session after its own fourth-quarter results, so we leave it out of the launch count.²³

On 27 March, Investing.com, following Fortune, reported a leaked Anthropic draft that described a model called Claude Mythos as “far ahead of any other AI model in cyber capabilities”.⁴ CrowdStrike, Palo Alto Networks and Zscaler each closed about 6% lower. The Nasdaq Composite fell 2.15% and IGV 3.59% the same day, so the part of the fall peculiar to security was a few points.²⁰

Project Glasswing followed on 7 April: Anthropic gave a restricted model, Claude Mythos Preview, to 12 launch partners, among them CrowdStrike and Palo Alto Networks, and to more than 40 other organisations that maintain critical software.⁵ That day the two named partners rose, CrowdStrike 6.2% and Palo Alto 4.9%. On 8 April Anthropic put Claude Managed Agents, which runs customers’ agents on Anthropic’s own infrastructure, into public beta.⁶ Over the next two sessions Akamai fell 21.3%, Cloudflare 21.0%, Okta 17.2% and Zscaler 14.4%, while the Nasdaq rose 1.2%.²⁰

Claude Fable 5 was released on 9 June, with Claude Mythos 5 offered separately for defensive security work to verified organisations only.⁹ CIBR fell 2.08% that day and IGV 2.82%.²⁰

02What the coverage blamed, and what the companies said

February. Reuters wrote that investors were weighing the tool’s possible effect on the industry. Shrenik Kothari of Robert W. Baird called it “the continuation of a panic-driven, narrative-led selloff” and said the tool does not handle real-time work such as stopping live intrusions.² Wedbush called the move the “AI Ghost Trade” and “the wrong reaction in the long-term for clear winners”.³ Anthropic’s own post presents the tool as working alongside existing ones: teams “review findings and iterate on fixes within the tools they already use”.¹ CrowdStrike issued no statement that day; in its results on 3 March, George Kurtz said “CrowdStrike is mission-critical infrastructure” as enterprises adopt AI, reporting ending annual recurring revenue of US$5.25bn, up 24%.³¹¹

March. Investing.com called the fall “AI fear” sparked by the leak. Anthropic blamed “human error” in configuring its content system and said it was “being deliberate about how we release” the model.⁴

April. Two readings appeared on the same day. MarketScreener tied the sell-off to Mythos Preview and to investor fear that AI will speed up vulnerability discovery and weaken traditional tools.⁷ webhosting.today tied the falls in Cloudflare, Akamai and Fastly to Managed Agents instead, and quoted Ben Reitzes of Melius Research: “The market is getting it right in SaaS. No platform is safe.”⁸ We do not choose between them. The named partners spoke for the project: CrowdStrike’s chief technology officer, Elia Zaitsev, said: “The window between a vulnerability being discovered and being exploited by an adversary has collapsed”.⁵ Cloudflare made no public statement about the launch, webhosting.today reported.⁸

June. ERP Today named Workday, Oracle and Palantir, each down about 3% in the afternoon, on concern that “more capable AI agents could challenge parts of the traditional software subscription model”. It named no security company.¹⁰ A week earlier Palo Alto Networks’ chief executive, Nikesh Arora, had said in his results: “The latest advancements at the AI frontier have increased the level of urgency around cybersecurity”.¹⁸

03How far they came back

CrowdStrike regained its 19 February close on 5 March. After the leak it took four sessions to regain its 26 March close; after the April falls, eight sessions; after Fable, three.²⁰ On 22 May Yahoo Finance reported CIBR “up about 25% this month”, with seven straight intraday records; it described the trade as “part software, part cloud, part AI build-out, and part old-fashioned enterprise spending” and named no single cause.¹⁹ By 27 October Okta closed at 2.76 times its 19 February price, Palo Alto 2.66 times, Fortinet 2.27 times, SentinelOne 1.89 times, Cloudflare 1.70 times and Zscaler 1.54 times. CIBR was up 66.4%, IGV 36.7% and the Nasdaq Composite 16.7%.²⁰

Two stocks did not follow the line. Zscaler took until 18 May to regain its February price, then lost 31.5% after its results. Akamai regained its 8 April close on 5 May, rose 26.6% after its results, and closed 27 October 14.1% below that 8 April close.²⁰ In August CrowdStrike gave its own reading of the year: “The Mythos moment translated into mass-market acceptance that AI adoption needs security, and that’s CrowdStrike.”¹²

04Results days moved them more

Zscaler’s 26 May release showed revenue up 25% and annual recurring revenue up 25%, or 21% without its Red Canary purchase, and cut its free-cash-flow margin outlook from 26.5–27% to 22.8–23.3% on higher capital spending.¹³ Barchart attributed the next day’s fall to fourth-quarter revenue guidance slightly below estimates, a capex warning, two departed sales leaders, and fear that AI “could encourage companies to build more tools in-house”.¹⁴ Jay Chaudhry, Zscaler’s chief executive, said in the release that zero trust “has never been more essential in securing against threats exposed by frontier models”.¹³

On 7 May Cloudflare reported revenue up 34% and announced about 1,100 job cuts as it moves to an “agentic AI-first operating model”; Matthew Prince called AI “the biggest tailwind we’ve ever seen in Cloudflare’s history”.¹⁵ The Register tied the 23.6% fall to the job cuts. The same evening Akamai disclosed a US$1.8bn, seven-year commitment from “a leading, U.S. based frontier model provider”, which The Register reported Bloomberg had identified as Anthropic.¹⁶¹⁷ CrowdStrike’s 26 August release reported net new annual recurring revenue up 51% and raised guidance; it rose 20.5% the next session, a day IGV also rose 7.7%.¹²²⁰

05What a security buyer takes from it

Nothing in the product you license changed on those launch days. Claude Code Security was a research preview and Mythos Preview went only to named partners and maintainers.¹⁵ What tells you whether a vendor will be there at renewal, and how hard it will negotiate, is in its filings: CrowdStrike held US$5.01bn of cash and made US$377m of free cash flow in the quarter to 31 July; Cloudflare held US$4.16bn of cash and securities at 31 March; Zscaler made US$136m of free cash flow in the quarter to 30 April.¹²¹⁵¹³