Anthropic launches Claude Mythos for cyber defense, after first leaking its own drafts

Anthropic has launched Claude Mythos, a specialized AI model that automatically finds vulnerabilities in software. By the end of May 2025, the system had identified more than 10,000 critical vulnerabilities in real-world software. The launch story carries a notable irony: a few weeks before the official announcement, the company itself caused a large-scale leak of internal files through its own website.

Before the launch, a leak of its own data

In late March, it emerged that Anthropic's website had been misconfigured. About 3,000 unpublished files, including draft articles, PDF documents and images, were publicly accessible and indexed by search engines. The people who found them were not attackers but researchers from LayerX and the University of Cambridge: there was no hacking, just specialists browsing publicly available resources who stumbled on someone else's material by accident. Fortune reported the discovery.

Among the leaked drafts were texts in which Anthropic itself described its upcoming model as posing "unprecedented cyber risks", meaning it could potentially do serious damage in the wrong hands. A company that positions itself as the most responsible AI developer suffered a classic leak through a misconfigured website. Many saw the situation as symbolic: a story about unprecedented cyber capabilities began with a very precedented hole in the company's own infrastructure.

Official launch: partners and first numbers

On April 7, Anthropic formally unveiled Claude Mythos Preview as part of Project Glasswing. The announced funding is $100 million. The consortium's partners include:

• AWS, Apple, Cisco
• Google, Microsoft, NVIDIA
• Palo Alto Networks and other major industry players
• 40 pioneer organizations acting as first customers

The model is built for professional offensive security: it analyzes code and finds vulnerabilities that a human analyst could miss. One telling example is a vulnerability in OpenBSD that had gone unnoticed for about 27 years. By May 26, Claude Mythos had found more than 10,000 critical vulnerabilities in critical software. The scale impressed market participants.

"This is the most important cyber alliance since the creation of CISA," said the CEO of

Palo Alto Networks.

Access went beyond the planned limits

Alongside the launch, it emerged that the real Claude Mythos API had become accessible to outsiders through partners and the supply chain, before the protective architecture around the product was fully built. Technical documentation on how Mythos capabilities should be used in public scenarios also became available earlier than planned.

Effectively, a tool for finding vulnerabilities began to spread while key components of its own secure distribution were not yet ready. No confirmed breaches or publicly known exploits were recorded, but the situation raised legitimate questions about Anthropic's internal processes.

What this means

Claude Mythos is a real step toward automating cybersecurity at a level that was not possible before. Tens of thousands of vulnerabilities found, a large consortium and serious funding point to a working enterprise product. But the story around the launch raises a fair question: how closely do Anthropic's own security standards match what the company promises to deliver to its customers.