Anthropic Calls Mythos Too Dangerous: The Model Found Holes in the Internet's Core Software

Anthropic built Mythos as a general-purpose frontier model, but it soon realized it had more than just another strong AI for code. In internal tests, Mythos began finding vulnerabilities in the core software that underpins most of modern computing infrastructure, and turning them into working exploits. The company then decided not to release the model publicly and moved it into a closed mode for a limited group of partners.

The turning point came during internal evaluations, when Anthropic researcher Nicholas Carlini began deliberately testing the model on malicious scenarios. Mythos surprised even people who professionally stress-test AI and work in cybersecurity. Anthropic's internal team concluded that the model can find and exploit zero-day vulnerabilities in all major operating systems and all major browsers. Notably, Mythos was not built as a specialized cyber tool: according to the company, its dangerous skills emerged as a side effect of a general leap in programming, reasoning and autonomous tool use.

It then became clear these were not demo tricks. Anthropic disclosed several examples of problems that have already been fixed: a 27-year-old vulnerability in OpenBSD, a 16-year-old bug in FFmpeg that automated systems had run past millions of times without noticing, and chains of vulnerabilities in the Linux kernel that allowed escalation from ordinary user access to full control of the machine. In one test, Mythos built a browser exploit from four vulnerabilities on its own and was able to bypass several layers of isolation at once.

According to the Anthropic security team's blog, more than 99% of the problems the model found had not yet been fixed at the time of publication, so the company is not disclosing technical details and is working through coordinated vulnerability disclosure.

The response was Project Glasswing, which Anthropic announced on April 7, 2026. Instead of a normal release, the company opened access only to select participants: the named launch partners include AWS, Apple, Google, Microsoft, NVIDIA, Cisco, CrowdStrike, Palo Alto Networks, the Linux Foundation and JPMorganChase. More than 40 other organizations responsible for critical software and infrastructure also received access. Anthropic stresses that it wants to give defenders a head start: the company committed up to $100 million in credits for using Mythos Preview and another $4 million to support open source security. No public launch for all users is planned at this time.

The story does not end there, because the consequences reach well beyond a single lab. Banks and government agencies have begun urgently assessing what happens if models of this class reach not only defenders but also criminal groups or state-sponsored hackers. The financial sector is especially nervous: if the window between discovering a vulnerability and exploiting it shrinks from weeks and months to hours, the systems that handle payments, settlement and data storage would be at risk. That is why discussions about Mythos quickly emerged not only at the largest tech companies, but also among regulators and major financial institutions.

The main takeaway is that the industry has entered a new phase. Until now, the debate was mostly about whether language models could help write malicious code. The Mythos story shows a harsher scenario: a frontier model can hunt for weak points in complex codebases on its own, assemble them into working attack chains, and do so at a scale most human teams cannot match.

For the market, this changes the logic: the question is no longer whether to release such systems as an ordinary product, but whether developers, infrastructure providers and governments can build defenses before similar capabilities become widespread. Anthropic's decision to hold back the release looks less like marketing-driven caution and more like an acknowledgment that the line between useful AI for development and a tool for cyber offense has become much thinner.