Anthropic has built a model capable of finding and exploiting previously unknown vulnerabilities across major operating systems and browsers. Its response is to keep the model private.
Claude Mythos Preview operates through Project Glasswing, a controlled programme involving AWS, Apple, Cisco, Google, Microsoft, Nvidia, the Linux Foundation and other critical infrastructure organisations. More than 40 additional maintainers receive access, backed by up to $100 million in usage credits and $4 million in donations.
General reasoning crossed a security threshold
Mythos was not trained specifically for cybersecurity. Its capability emerged from broader improvements in code, reasoning and autonomy.
The same skills that help a model patch software also help it exploit weaknesses. Mythos largely saturates existing security benchmarks, pushing evaluation toward real zero-day discovery.
The model found a 27-year-old OpenBSD bug and autonomously identified and exploited a 17-year-old FreeBSD remote-code-execution flaw. After the initial instruction, no human participated in the latter discovery and exploit.
Anthropic researcher Nicholas Carlini says the model can chain three, four or five vulnerabilities into a sophisticated outcome. That ability makes conventional single-bug benchmarks an incomplete measure of risk.
Controlled access favours defenders first
Anthropic says general release would create severe risks for economies, public safety and national security. The company has briefed senior US officials while giving trusted vendors and maintainers an opportunity to find and repair weaknesses.
Open-source projects are a central beneficiary. Critical code often relies on maintainers without large security teams. Anthropic donated $2.5 million to Alpha-Omega and OpenSSF and $1.5 million to the Apache Software Foundation.
Project Glasswing attempts to distribute defensive capability without distributing the model itself. Participants can scan infrastructure and coordinate fixes inside a controlled coalition.
The approach cannot permanently contain similar capability. Anthropic acknowledges that other models will reach it, potentially in the hands of actors with fewer safeguards.
Frontier release norms are changing
Anthropic previously reported an AI-assisted campaign by a Chinese state-linked group against roughly 30 targets, with agents performing much of the tactical work. That history makes offensive autonomy more than a hypothetical concern.
OpenAI also classified GPT-5.3-Codex as highly capable for cybersecurity under its preparedness framework. Frontier labs appear to be converging on controlled deployment when a model crosses a capability threshold.
Anthropic plans to introduce new safeguards with a future Claude Opus model before considering wider Mythos-class use. Testing them on a less dangerous system may reveal weaknesses without exposing the most capable tool.
This strategy creates difficult governance questions. Private access concentrates power among selected companies and governments. Open release spreads defensive expertise but also removes meaningful control over offensive use.
Project Glasswing chooses temporary asymmetry: defenders receive early access while broad release waits. Its success will depend on how quickly vulnerabilities are fixed and whether benefits reach maintainers beyond the largest partners.
Mythos Preview demonstrates that general coding progress can produce security capability faster than release policy adapts. The important benchmark is no longer merely whether a model can find a flaw. It is whether institutions can deploy that capability to strengthen the internet before the same autonomy becomes widely available to exploit it.
Effective responsible coordinated disclosure is the operational bridge. A model can find vulnerabilities faster than maintainers can understand, patch and distribute fixes, creating a dangerous backlog of knowledge. Project Glasswing needs prioritisation, secure communication and enough engineering support to convert findings into protected systems. Credits provide access to the model, while direct funding helps open-source organisations perform the less visible work after discovery. Measuring patches deployed and exposure reduced will say more about defensive impact than the raw number of bugs the model reports.
