Anthropic's yet-to-be-released Claude Mythos Preview AI model has autonomously identified thousands of severe zero-day vulnerabilities across all major operating systems and browsers, leading the company to launch Project Glasswing—a defensive cybersecurity coalition backed by up to $100 million in Mythos usage credits.
The model completed training and was publicly announced on April 7, 2026, after internal details emerged in late March through a misconfigured content management system that exposed approximately 3,000 internal files. Claude Mythos Preview is not being released to the general public or via Anthropic's general API; access is limited to a curated group of partners.
Claude Mythos Preview's Remarkable Performance
In cybersecurity benchmarks, Mythos scored 83.1% on Cybergym compared to Claude Opus 4.6's 66.6%, 93.9% on SWE-bench Verified versus 80.8%, 77.8% on SWE-bench Pro versus 53.4%, and 56.8% on Humanity's Last Exam (without tools) versus 40.0%. The model requires no cybersecurity-specific training to find these bugs; its improvements come from broader advances in reasoning, multi-step planning, and autonomous agent behavior.
Given a target codebase in an isolated container, Mythos reads source code, forms hypotheses about memory safety flaws, compiles and runs the software, employs debuggers like Address Sanitizer, ranks files by vulnerability likelihood, and produces validated bug reports with working proof-of-concept exploits. Some exploits required almost no human intervention.
Decades-Old Vulnerabilities Uncovered
According to Tomshardware.com, Mythos autonomously discovered a 27-year-old OpenBSD TCP SACK vulnerability—a subtle integer overflow allowing an attacker to remotely crash any responding host by crafting malicious packets. The discovery took approximately 1,000 runs at a total cost under $20,000. A 16-year-old FFmpeg H.264 bug that survived more than five million automated tests and multiple reviews was also found by Mythos.
In browser testing, Mythos generated 181 full shell exploits and 29 instances of register control against Firefox 147's JavaScript engine, while Claude Opus 4.6 produced only two shell exploits in the same test suite. The model also built working privilege escalation chains in the Linux kernel, from user to root, after filtering 100 current CVEs down to 40 exploitable candidates and successfully exploiting more than half.
Human validators reviewed 198 of Mythos's vulnerability reports and agreed with its severity ratings in 89% of cases, with 98% agreement within one severity level.
Project Glasswing Defense Coalition
As of April 7, 2026, less than 1% of the identified bugs have been fully patched. Anthropic is coordinating responsible disclosure, publishing cryptographic SHA-3 commitments for unpatched issues, and following a 90-plus-45-day timeline. The FreeBSD NFS server remote code execution bug CVE-2026-4747, a 17-year-old vulnerability granting full unauthenticated root access, has already been made public.
Project Glasswing, announced alongside the model, includes founding partners Amazon Web Services, Apple, Broadcom, Cisco, Crowdstrike, Google, JPMorganChase, Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks, with access extended to over 40 additional critical software organizations. Anthropic has committed $4 million in donations to open-source security: $2.5 million to Alpha-Omega via OpenSSF and $1.5 million to the Apache Software Foundation.
The company acknowledged that AI tools like Mythos lower the barrier for finding and exploiting vulnerabilities, warning of near-term risks from state actors (China, Iran, North Korea, Russia) and criminal groups if similar capabilities spread without control. Anthropic stated that future versions of Claude Opus will include safeguards to detect and block dangerous cybersecurity outputs, and plans to introduce a cyber verification program for vetted security experts. A public report on partner findings and patched vulnerabilities is expected within 90 days.
Additionally, Anthropic registered AnthroPAC with the FEC on April 3, 2026, forming its first employee-funded political action committee ahead of the midterm elections, with AI at the forefront.