ShinyHunters says it has breached internal systems linked to Anthropic and its Mythos model, releasing several screenshots online as proof. The leaked images appear to show a user management panel, an AI experiment dashboard, and pages tracking model performance and cost. The claim quickly spread on X, where several opinion leaders and SlowMist security chief 23pds reposted warnings.
Leaked screenshots appear to expose internal dashboard views
The published images fall into three categories: user administration, AI experiment monitoring, and model performance and cost analysis. That is significant on its face. Still, the authenticity of the screenshots has not been independently verified, leaving open the question of whether the material actually came from an Anthropic environment.
ShinyHunters has been highly active since 2020. The group is known for targeting large databases, cloud services, and third-party integration systems, typically seeking sensitive data for sale on dark web markets or for extortion.
Bloomberg had already reported unauthorized access to Mythos Preview
The timing drew added attention because Bloomberg previously cited people familiar with the matter as saying that an unidentified group was already using Mythos Preview on the same day Anthropic announced the start of testing. According to that report, access came through two separate routes.
One route involved a person. A member of the group reportedly worked for a third-party contractor serving Anthropic, and that role provided credentials to the Mythos environment; the access path was then shared with others in the group. The second route involved URL discovery. Because Anthropic used a predictable naming pattern when deploying other models, the group was said to have guessed the Mythos Preview access location directly, without relying on conventional hacking techniques.
Anthropic says it is reviewing a report tied to a vendor environment
Anthropic said it is investigating a report alleging unauthorized access to Claude Mythos Preview through a third-party vendor environment. The company also said it has not found any impact from the unauthorized activity on its systems so far.
At this stage, the confirmed public facts are limited: ShinyHunters has made the claim and posted screenshots, and Bloomberg had earlier reported unauthorized access involving Mythos Preview. The source material does not establish whether these refer to the same incident, whether the screenshots are genuine, or how broad any data exposure may be.