Anthropic says an unreleased preview model called Claude Mythos has autonomously uncovered thousands of high-severity zero-day vulnerabilities across major operating systems and web browsers, a claim that immediately raises the stakes in the race between offensive and defensive uses of advanced AI. In response, the company launched Project Glasswing, a cybersecurity defense coalition backed by up to $100 million in Mythos usage credits intended for defenders rather than general public deployment.
The company has not opened Claude Mythos Preview to the public or to its standard API users. Instead, access has been restricted to a select group of partners after internal testing showed the model could identify and exploit previously unknown software flaws at a speed and scale that, according to Anthropic, exceeds both human experts and earlier AI systems. The announcement followed reports that internal details had leaked in late March through a misconfigured content management system that exposed roughly 3,000 internal files.
Benchmark gains suggest a major capability jump
Anthropic describes Mythos as the largest single-model capability increase in the history of frontier AI, and the performance numbers it shared were designed to support that framing. On the cybersecurity benchmark Cybergym, Claude Mythos scored 83.1%, compared with 66.6% for Claude Opus 4.6. On SWE-bench Verified, it posted 93.9% versus 80.8%. On SWE-bench Pro, the model reached 77.8%, a wide improvement over the prior model’s 53.4%. On Humanity’s Last Exam without tools, Mythos scored 56.8%, compared with 40.0% for its predecessor.
Anthropic argues that these gains were not the result of narrow cybersecurity-specific tuning. Instead, the company attributes the results to broader advances in reasoning, multi-step planning, and autonomous agent behavior. Given a target codebase in an isolated container, Mythos can inspect source code, form hypotheses about memory-safety issues, compile and execute software, use debugging and sanitization tools such as Address Sanitizer, prioritize files by vulnerability likelihood, and ultimately produce bug reports validated with working proof-of-concept exploits.
That workflow matters because it suggests Mythos is not merely guessing at patterns. It appears to follow an end-to-end vulnerability research loop: reading, testing, refining, validating, and reporting. In practical terms, that makes it more useful than systems that can describe security concepts but struggle to verify them in live code.
Old vulnerabilities survived for years until Mythos found them
Some of the examples highlighted by Anthropic and external reporting are especially striking because of their age. One case involved a 27-year-old OpenBSD TCP SACK vulnerability, described as a subtle integer overflow that allows a remote attacker to crash any responding host by crafting malicious packets. According to the report, Mythos discovered the issue autonomously after roughly 1,000 runs, at a total cost of less than $20,000.
Another example involved a 16-year-old FFmpeg H.264 bug that had reportedly survived more than five million automated tests as well as multiple audits before Mythos identified it. These cases are central to Anthropic’s argument that the model is not simply accelerating ordinary vulnerability discovery, but surfacing defects that had persisted despite years of conventional security scrutiny.
The browser-related results also drew attention. In tests against the JavaScript engine in Firefox 147, Mythos generated 181 full shell exploits and 29 register-control cases. Anthropic contrasted that with Claude Opus 4.6, which reportedly produced only two shell exploits in the same test set. The company also said Mythos built functional Linux kernel privilege-escalation chains from user to root on servers. After filtering 100 recent CVEs down to 40 exploitable candidates, the model successfully exploited more than half of them.
To assess reliability, human validators reviewed 198 vulnerability reports generated by the model. They agreed with Mythos’ severity ratings in 89% of cases, and the agreement rose to 98% when allowing for a difference of one severity level. Those figures, if replicated independently, would suggest the system is producing outputs that are not only numerous, but often credible enough to be useful in real security workflows.
Project Glasswing aims to put the capability in defenders’ hands first
Anthropic says fewer than 1% of the bugs identified so far have been fully remediated, underscoring how early the process remains. The company says it is coordinating responsible disclosure by publishing SHA-3 cryptographic commitments for unresolved issues while withholding full technical details until a 90-plus-45-day disclosure window has passed.
One vulnerability already referenced in disclosure is CVE-2026-4747, a 17-year-old remote code execution flaw in the FreeBSD NFS server that can grant unauthenticated attackers full root access. By naming examples without releasing everything at once, Anthropic appears to be trying to balance public transparency with the immediate risk of weaponization.
Project Glasswing, announced alongside Mythos, is Anthropic’s attempt to channel these capabilities toward defense before equivalent systems become broadly accessible. Founding partners include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks. Anthropic also said access is being extended to more than 40 additional critical software organizations.
Beyond compute and model access, Anthropic committed $4 million to open-source security. Of that amount, $2.5 million will go to Alpha-Omega through OpenSSF under the Linux Foundation, and $1.5 million will go to the Apache Software Foundation. The funding signals that the company views open-source infrastructure as a priority target for defensive reinforcement, especially given how much modern software stacks depend on a relatively small number of widely used projects.
Powerful offensive potential remains the central concern
Anthropic openly acknowledged that AI systems like Mythos lower the barrier to discovering and exploiting vulnerabilities. That creates a near-term risk if similar capabilities spread without meaningful controls. The company specifically warned about misuse by state actors and criminal groups, and referenced threats associated with China, Iran, North Korea, and Russia. In Anthropic’s framing, the industry may face a transitional period of turbulence before defenders fully absorb and deploy the same class of technology at scale.
That warning is one of the most important elements of the announcement. The same attributes that make Mythos useful for defenders—speed, autonomous exploration, exploit construction, and scalable triage—also make it inherently dual-use. The fact that Anthropic chose not to release the model publicly reflects how seriously it appears to take that dual-use risk.
The company said future Claude Opus releases will include stronger safeguards designed to detect and block dangerous cybersecurity outputs. Anthropic also plans to introduce a cyber verification program for vetted security professionals, suggesting a more controlled access model for sensitive functionality rather than broad consumer availability.
A public report summarizing partner findings and remediated vulnerabilities is expected within 90 days. Until then, the announcement leaves the industry with two simultaneous conclusions: advanced AI may dramatically improve defensive security research, and it may also compress the timeline in which dangerous offensive capability becomes widely usable. For the software ecosystem, the question is no longer whether AI can materially change vulnerability discovery, but whether governance and defensive coordination can keep pace with the models producing those results.