Anthropic deems Mythos too dangerous: the model can break into foundational systems

Anthropic has effectively paused the usual launch playbook for a new AI model: after internal reviews, the company concluded that Mythos is too dangerous for a broad release. Anthropic's own specialists assessed that the model can do more than help with code: it can independently find and exploit critical vulnerabilities in the software infrastructure that underpins much of today's digital economy. That is why Mythos was not made publicly available and instead moved into a strictly limited-use mode.

The warning signs appeared during internal testing. Nicholas Carlini, one of Anthropic's security researchers, got early access to Mythos and began probing how far the model could go in offensive scenarios. The results were so strong that the conversation inside the company quickly shifted from routine quality evaluation to the potential damage if the model leaked or became widely accessible.

In subsequent technical materials, Anthropic clarified that Mythos can find and then exploit zero-day vulnerabilities in every major operating system and every major web browser if a user gives it that task. These are not minor bugs but flaws in the foundational layers of computing infrastructure. Anthropic says the model has already found thousands of serious vulnerabilities, including issues in the Linux kernel, FFmpeg, OpenBSD, FreeBSD, and other components that servers, clouds, corporate networks, and consumer devices depend on.

Some of these weaknesses had existed for decades: the company specifically cited a now-patched 27-year-old bug in OpenBSD and an old FFmpeg vulnerability that automated tools had previously missed. Another point matters too: Mythos can not only flag a problem but also assemble a working exploit chain, combining several weaknesses into a full-fledged attack. Anthropic stresses that the model was not specifically trained to be a "hacker."

According to the company, these capabilities emerged as a side effect of broader gains in coding, reasoning, and autonomous operation. That is arguably the most troubling signal for the industry: dangerous cyber capabilities are emerging not in a narrowly specialized military system but in a general-purpose frontier model. What's more, Anthropic described cases where employees with no formal background in offensive security ran Mythos overnight and woke up to a ready, working exploit.

That sharply lowers the barrier to entry: what once required rare expertise is increasingly a matter of the right prompt and enough compute. Instead of a public launch, the company opened Project Glasswing, a closed program that gives access to Mythos to major technology and cybersecurity players, as well as more than 40 organizations that maintain critical software. Named partners include Amazon, Apple, Google, Microsoft, Cisco, CrowdStrike, Palo Alto Networks, the Linux Foundation, and JPMorgan Chase.

Anthropic pledged up to 100 million dollars in compute credits for this work, plus 4 million dollars in direct support for organizations working on open source security. The logic is simple: first give defenders time to close as many holes as possible in the shared digital foundation, and only then consider wider distribution of such models. The story quickly spread beyond a single company.

On April 7, 2026, US Treasury Secretary Scott Bessent and Fed Chair Jerome Powell convened a closed-door meeting with the heads of the largest banks to discuss the risks posed by Mythos and models of its class. The European Central Bank began gathering information on how prepared banks are for this new type of threat, and the Bank of England publicly called for a faster understanding of what such systems mean for financial stability. The reason is clear: banks, government agencies, and critical infrastructure operators still rely on complex, often outdated stacks, where one successful vulnerability chain can hit many services at once.

The main takeaway is not that Anthropic built a "too smart" model, but that the industry appears to have entered a new phase of cyber risk. Mythos is a rare case of a developer restricting a release on its own because of its product's offensive capabilities. More important still: even if this particular model stays under control, its class of capabilities will likely stop being unique soon.

So the debate is no longer about whether to release Mythos publicly, but whether companies, banks, and governments can rebuild their defenses before such tools fall into the wrong hands.