The AI That Could Hack the Planet (And Find Out Why Its Creator Is Nervous About It).
Anthropic built an AI model so capable that it decided the general public could not have it.
Since April 7, when Anthropic announced Mythos, a model with a demonstrated talent for cracking open software that would make the most seasoned penetration tester look twice, the company has been in the uncomfortable position of defending a tool it is simultaneously afraid of. It built it, tested it, watched what it did, and pulled it back. For a company that markets itself as the safety-first AI lab, that is not a comfortable place to be.
What exactly is Mythos? Why has it rattled finance chiefs, woken up government regulators, and triggered quiet panic among open-source maintainers who guard critical software with skeleton crews? And why does a separate source map leak involving Anthropic’s own tools make the picture even messier? This piece walks through all of it, with the numbers to back it up.
What Is Mythos?
Anthropic announced Mythos on April 7, 2026. Rather than a public release, the company gave access to a controlled group under an initiative called Project Glasswing. The 12 founding partners are Anthropic itself, Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Beyond that core group, over 40 additional organisations that build or maintain critical software infrastructure also received access. Anthropic committed $100 million in model usage credits and $4 million in direct grants to open-source security organisations to support the initiative.
Alongside the launch, Anthropic published a detailed technical report from its Frontier Red Team. The report is unusually candid. It documents exactly what the model can do, how the team measured it, and why they believe it crosses a line that previous AI models did not. The model operates like a senior software engineer with a specialisation in offensive security. It reads codebases, identifies subtle flaws, reasons about how separate bugs can be combined, and then writes working exploit code. Not theoretical sketches. Functional exploits.
Mythos’s found thousands of high- and critical-severity zero-day vulnerabilities across every major operating system and every major web browser. The Council on Foreign Relations, citing Anthropic’s own data, noted that one flaw was found in code that had been tested five million times by automated tools without detection. Over 99% of the vulnerabilities discovered remained unpatched at the time of the April 7 announcement.
The Benchmark Gap: What the Numbers Actually Show
The Firefox benchmark is where the gap between Mythos and its predecessors becomes hardest to dismiss. Anthropic’s red team ran it twice, using identical conditions.
When tested against known JavaScript engine vulnerabilities in Firefox 147, Claude Opus 4.6, the previous flagship model, produced working shell exploits on two occasions out of several hundred attempts. Mythos Preview ran the same test and produced 181 working exploits, with register control achieved in 29 additional cases. That is a roughly 90x improvement in a single generation, as VentureBeat noted. Opus 4.6 had a near-zero percent success rate at autonomous exploit development overall.
The OSS-Fuzz benchmark tells a similar story. Anthropic regularly tests its models against roughly 1,000 open-source repositories from the OSS-Fuzz corpus, scoring their worst result on a five-tier severity scale ranging from basic crashes (tier 1) to full control-flow hijack (tier 5). Across roughly 7,000 entry points, Sonnet 4.6 and Opus 4.6 each reached tier 1 in 150 to 175 cases, tier 2 about 100 times, and achieved just one crash each at tier 3, with nothing above that. Mythos Preview produced 595 crashes at tiers 1 and 2, a handful at tiers 3 and 4, and hit tier 5, full control-flow hijack, on 10 separate, fully patched targets.
Anthropic also ran Mythos against a list of 100 Linux kernel CVEs from 2024 and 2025. The model filtered these to 40 it judged exploitable, then produced working privilege-escalation exploits for more than half of them. Many involved chaining two to four separate low-severity vulnerabilities together, defeating kernel address-space layout randomisation (KASLR) via race conditions and use-after-free bugs, then injecting SSH keys for root access. All without human guidance after the initial prompt.
The cost figures are what change the threat calculus most. A thousand-run OpenBSD campaign that found a 27-year-old denial-of-service vulnerability cost under $20,000 in total, working out to roughly $50 per successful find. The Linux kernel privilege-escalation chains that bypassed KASLR and CONFIG_HARDENED_USERCOPY cost under $2,000 each. The FreeBSD remote code execution exploit described below came in under $1,000. As one analyst observed, Mythos is not doing technically novel offensive work, it is doing well-understood offensive work at a fraction of the cost and time that previously required elite human specialists.
“What Anthropic just demonstrated is that a language model can now compress vulnerability discovery, exploit development, multi-vulnerability chaining, and defense bypass into hours, at a cost measured in hundreds or low thousands of dollars.”
— PostQuantum Security Analysis, April 8, 2026
Specific Vulnerabilities: The Ones Anthropic Can Talk About
Because over 99% of what Mythos found remains unpatched and under coordinated disclosure, Anthropic can only publicly discuss a small fraction of its findings. The disclosed cases are still illustrative.
The most high-profile is CVE-2026-4747, a 17-year-old remote code execution vulnerability in FreeBSD’s NFS server. The flaw is a stack buffer overflow in the RPCSEC_GSS authentication handler. An attacker-controlled packet is copied into a 128-byte stack buffer, but the XDR layer permits credentials up to 400 bytes, leaving 304 bytes of overflow. FreeBSD lacks the stack protection and kernel address randomisation that would complicate exploitation on a modern Linux host, making the path to full unauthenticated root access relatively direct. Mythos built a 20-gadget Return Oriented Programming chain split across multiple network packets to exploit it, fully autonomously after a single prompt.
A second disclosed finding is a 16-year-old vulnerability in FFmpeg’s H.264 codec. The flaw survived every fuzzer and human code review that examined it in the intervening years. Mythos found it by reasoning about code semantics rather than through pattern-matching or fuzzing. The campaign cost approximately $10,000.
The 27-year-old OpenBSD denial-of-service bug is the third. An integer overflow in the TCP SACK implementation allows a remote attacker to crash any OpenBSD host responding over TCP. Mythos surfaced it across roughly 1,000 scaffold runs. VentureBeat notes this was a finding in code tested five million times by automated tools without detection.
Not every claim has gone unchallenged. A detailed technical critique from FlyingPenguin argues that CVE-2026-4747 was already a publicly filed advisory before Mythos found it, that FreeBSD’s lack of modern mitigations made the exploit straightforward, and that Anthropic’s claim of “fully autonomous discovery” glosses over context that was already in the advisory. The AISLE research group tested eight open-weight models against the same CVE and found all eight detected it, including one with 3.6 billion parameters costing $0.11 per million tokens. AISLE’s conclusion was not that Mythos is overhyped across the board, but that the examples Anthropic chose to publicise may not represent the full gap between Mythos and existing tools.
“Only a handful of Anthropic models out of thirteen tested get the harder vulnerability classes right. The FreeBSD detection is commoditised: every model gets it, including a 3.6-billion-parameter model at $0.11 per million tokens.”
— AISLE Research Group, AI Cybersecurity After Mythos, April 2026
The Source Map Problem: Anthropic’s Own Wound
Roughly a week before Mythos was announced, a quieter story was circulating in security circles. On March 31, 2026, reports emerged that Anthropic’s npm-distributed CLI tool, Claude Code, had shipped with source map metadata accessible enough for outsiders to reconstruct substantial portions of the original TypeScript source. Multiple GitHub mirrors appeared claiming to be derived from the cli.js.map file for version 2.1.88 of the @anthropic-ai/claude-code package. Anthropic’s changelog confirms 2.1.88 as a real public release dated March 30, 2026.
To understand why this matters you need to understand what source maps are. When developers build modern JavaScript applications for production, the code is run through a minifier that compresses it into a dense, unreadable bundle. This makes files smaller and faster to load, but it also makes the underlying logic far harder to reverse-engineer. Source maps are the debug companion to that process, a structured JSON file that maps the minified output back to the original readable source, line by line. In development environments they are essential. Accidentally left accessible in production, they hand a researcher or attacker a readable blueprint of the application.
This is not an exotic problem. Security firm Escape, after scanning their client base, found exposed source maps in 70% of organisations shipping production web apps. Apple walked into the same mistake in November 2025 when it shipped a redesigned App Store website with source maps enabled in production. Within hours, a developer had used a Chrome extension to pull the complete Svelte and TypeScript codebase off the live site. The GitHub repository was forked more than 8,000 times before Apple got it taken down.
The attack chain can extend well beyond reading source code. Ethical hacker Matthew Keeley, in a case documented by Sentry’s security blog, found that a publicly accessible .map file in a production build contained hardcoded Stripe API secret keys in the reconstructed source, enabling unauthorised payments. Ostorlab security researchers note that exposed source maps can also reveal full dependency trees, creating a surface for dependency confusion attacks against internal packages.
For Claude Code specifically, the concern goes beyond competitive intelligence about Anthropic’s implementation. CVE-2026-21852 describes a separate but related vulnerability. A malicious repository can set the ANTHROPIC_BASE_URL environment variable to intercept API calls before the trust prompt appears, potentially leaking API keys. A related CVE, CVE-2025-59828, existed because Yarn-related code could execute before directory trust was established. Making implementation details easier to reconstruct through source map exposure lowers the cost of finding and probing these kinds of pre-trust initialization bugs.
The source map incident and the Mythos announcement are two separate stories that Anthropic would probably prefer to tell on different news cycles. One is about its most powerful AI model exposing vulnerabilities in other companies’ software. The other is about Anthropic’s own CLI shipping with a configuration that made its source reconstructable. Both happened within the same week. The company finds itself on both sides of the same argument simultaneously.
Why the Patching Gap Is the Real Crisis
The core anxiety around Mythos is not the model itself sitting under controlled access. It is the collision between how fast AI can now find vulnerabilities and how slowly the industry patches them. Those two curves are moving in opposite directions at an accelerating rate.
On the discovery side, as of the first half of 2025, over 23,667 CVEs were filed globally in just six months, a 16% increase over the same period in 2024. The full-year 2025 count was projected to approach or exceed 50,000 disclosed vulnerabilities, roughly 130 new CVEs every single day requiring triage, patching, or other mitigation. That volume was unprecedented before Mythos existed.
On the patching side, the Adaptiva State of Patch Management 2025 report, surveying over 250 security and IT professionals, found that 77% of organisations need more than a week to deploy patches enterprise-wide, and 14% require more than four weeks. Separately, 71% of IT and cybersecurity professionals said patching is too complex and time-consuming. Even high-severity vulnerabilities take an average of 82 days to fix globally, according to Statista’s 2023 cross-industry benchmark, and low-severity ones take close to 10 months.
The exploitation window is compressing from the other direction too. Barracuda’s 2025 analysis found that attackers’ average time from vulnerability discovery to active exploitation had dropped from 63 days to 32 days. Unpatched vulnerabilities are the source of over 60% of data breaches.
This is the structural problem Mythos makes acute. Shane Fry, CTO of RunSafe Security, told Fortune, “Vulnerability discovery is outpacing patching. As vulnerability discovery and exploit development move faster, the idea that you can remediate everything in time just doesn’t hold.”
“Organizations are already struggling to keep up with patching across both IT and OT environments, and AI is only accelerating that gap.”
— Shane Fry, CTO, RunSafe Security (via Fortune)
Daniel Stenberg, chief maintainer of cURL, the open-source data transfer library present on virtually every networked device on earth, received 181 bug and vulnerability notifications in 2025 alone. That was roughly double the count from the previous two years combined. His team is six volunteers.
Six volunteers. A model that generates 181 working exploits overnight. Stenberg put it plainly in Bloomberg: he does not see how that equation resolves in the maintainer’s favour.
“Maybe we have critical systems that we can’t operate in a post-Mythos world, when we have so many zero-days hitting us all the time.”
— Joshua Wright, SANS Institute Fellow and Technical Adviser (via GovTech)
Tal Kollender, a former hacker and founder of cybersecurity platform Remedio, put the detection problem plainly in Fortune, a tool that finds thousands of vulnerabilities per minute is “an incredibly expensive alarm.” Finding risk faster than you can act on it does not make organisations more secure. Over 99% of the vulnerabilities Mythos found remain unpatched, Anthropic confirmed.
The financial sector has taken notice. JPMorgan Chase CEO Jamie Dimon, after being briefed on Mythos, told CNBC that while AI will eventually help defenders, it is first making companies more vulnerable, and that “a lot more vulnerabilities need to be fixed.” He warned the risk extends to exchanges and other financial infrastructure beyond the banks themselves.
“A lot more vulnerabilities need to be fixed.”
— Jamie Dimon, CEO of JPMorgan Chase (via CNBC)
The broader AI-enabled threat picture is already deteriorating. CrowdStrike’s data shows 78% of companies were hit by ransomware in the past year, and QBE Insurance Group projects ransomware attacks are on track to increase 40% by end of 2026 compared to 2024, from one attack every 11 seconds to one every 2 seconds by 2031. A recent PwC report noted that the time between a new AI capability’s release and its weaponisation by threat actors shrank dramatically in 2025 and is expected to continue narrowing in 2026.
Why Anthropic Is Nervous About Its Own Creation
Anthropic was not trying to build a hacking tool. The company was building a more capable general AI, and the offensive security capabilities arrived as a side effect of that work. The same improvements in code comprehension, reasoning, and autonomous action that make Mythos useful for patching software also make it useful for attacking it. Anthropic states this directly in the technical report, the cybersecurity capabilities were not explicitly trained. They emerged as a downstream consequence of general improvements.
The government response has been fast. The Hill reports that Anthropic briefed senior officials across multiple U.S. agencies before any external release, including CISA and the Center for AI Standards and Innovation. On the day Project Glasswing launched, Treasury Secretary Bessent and Federal Reserve Chair Powell convened a separate meeting with Wall Street executives, including the CEOs of Bank of America and Goldman Sachs, to discuss the implications for financial infrastructure. A person familiar with the White House’s response told The Hill that some officials had previously assumed AI development had plateaued; Mythos prompted a reassessment.
“This time, the threat is not hypothetical. Advanced language models are here.”
— Anthropic researchers, Mythos technical assessment (via The Hill)
David Lindner, CISO at Contrast Security, offered a twenty-five year practitioner’s perspective in Fortune. His argument is that finding vulnerabilities has never been the binding constraint: “We’ve never had a problem finding vulnerabilities. We find them every day. We actually have a pile of them that we just don’t fix.” He also raised a supply-chain concern that Anthropic’s controlled release strategy may not contain the capability for long: “Even if they, quote unquote, don’t release it, China will have a version in five or six months, and there’ll be an open-source version within a year or two.”
There are also limits to what Mythos can do. Evan Peña of Armadin told CNN that current AI models lack the contextual judgment a human attacker has about which data inside a target organisation is actually worth stealing. The Cloud Security Alliance’s Rich Mogull noted Mythos failed at remote kernel exploitation while succeeding locally. The AISLE group’s comparative tests suggest the specific vulnerabilities Anthropic publicised may not represent the widest gap between Mythos and already-available models.
The Controlled Release That Wasn’t Entirely Controlled
On April 21 — two weeks after Project Glasswing launched — Bloomberg reported that a small group of unauthorised users had been accessing Mythos Preview regularly since the day of the public announcement. According to Bloomberg, the group communicates through a private Discord channel dedicated to tracking unreleased AI models. Their method of entry was disarmingly low-tech: they made an educated guess about the model’s URL based on familiarity with the formatting conventions Anthropic uses for other model endpoints. No sophisticated intrusion was required. Access was also facilitated, at least in part, through shared accounts and API keys belonging to an individual employed at a third-party contractor working with Anthropic. Bloomberg said the group provided screenshots and a live demonstration as proof.
Anthropic confirmed it is investigating. “We’re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments,” the company told TechCrunch. It added that there is currently no evidence that the access impacted Anthropic’s core systems or extended beyond the contractor environment. The source described the group’s motivation to Bloomberg as curiosity-driven — “interested in playing around with new models, not wreaking havoc” — though security experts note that intent is largely irrelevant when the tool in question can produce working exploits for critical infrastructure overnight.
The episode carries weight beyond the immediate security question. Anthropic is currently suing the Department of Defense over its designation of the company as a supply-chain risk — a designation centred on whether Anthropic can reliably govern access to its own tools. An unauthorised access incident, even one apparently contained within a third-party vendor environment, gives ammunition to those in the administration who have argued otherwise. The Next Web noted that the mechanism of access — guessing a model’s URL from knowledge of Anthropic’s conventions — points to a specific failure mode: restricting a frontier AI capability through vendor relationships rather than technical controls creates a surface area that is harder to monitor and easier to circumvent than a closed API with strict authentication. Glasswing was designed as a controlled release. The question now being asked, quietly, in government and security circles alike, is how controlled it actually was.
Is There a Way Through This?
Anthropic’s long-term argument is that tools like Mythos will ultimately help defenders more than attackers, once the security landscape reaches a new equilibrium. Their technical report draws a parallel to software fuzzers: when AFL and similar tools arrived, fears that they would accelerate attacker discovery of vulnerabilities proved correct in the short term. Today, fuzzers like OSS-Fuzz are a core part of defensive security practice. Anthropic believes the same will happen here.
Their immediate defensive recommendations are concrete: organisations that have not integrated AI into vulnerability management should start now, using currently available frontier models that already find high- and critical-severity bugs across OSS-Fuzz targets, web applications, cryptography libraries, and the Linux kernel. Patch cycles should be compressed. CVE-tagged dependency updates should be treated as urgent rather than routine. Incident response pipelines should be automated where possible.
The Council on Foreign Relations called Mythos “an inflection point for AI and global security,” noting it is the first AI model ever withheld specifically because of its destructive security potential, and that the ability to autonomously discover zero-day vulnerabilities had previously belonged exclusively to highly specialised human experts. Anthropic has committed to a public findings report from Project Glasswing within 90 days of the April 7 announcement.
For now, the most capable offensive security AI ever documented sits under controlled access, while a curated group of the world’s largest technology companies quietly runs it against their own foundations. An unauthorised group is apparently running it too. The source code leak sits in the background as a reminder that even the company building these tools is not immune to the everyday packaging mistakes that have always plagued software releases. Whether Mythos ultimately helps defenders more than attackers is a question that will take years to answer. The period before that answer arrives is where all the exposure lives.
Sources
• Anthropic Red Team — Assessing Claude Mythos Preview’s cybersecurity capabilities
• Scientific American — What is Mythos and why are experts worried?
• The Hill — Anthropic’s Mythos model sparks cybersecurity concerns
• VentureBeat — Mythos Detection Ceiling: Security Teams Need a New Playbook
• SecureWorld — Anthropic’s Claude Mythos Autonomously Discovers, Exploits Zero-Days
• Help Net Security — Anthropic’s new AI model finds and exploits zero-days across every major OS and browser
• Tom’s Hardware — Anthropic’s latest AI model identifies thousands of zero-day vulnerabilities
• PostQuantum Security — Anthropic’s Mythos Preview and the End of a Twenty-Year Cybersecurity Equilibrium
• AISLE — AI Cybersecurity After Mythos: The Jagged Frontier
• FlyingPenguin — FreeBSD CVE-2026-4747 Log Suggests Mythos is a Marketing Trick
• Fortune — Mythos finds flaws faster than companies can patch them
• Fortune — Industry veteran: the real problem is fixing, not finding
• CNBC — Jamie Dimon on Anthropic’s Mythos
• CNN Business — Anthropic’s next model: experts weigh in
• Bloomberg — Anthropic’s Mythos Adds Strain on Cybersecurity Teams
• CBS News — Anthropic’s Mythos AI can spot weaknesses in almost every computer on Earth
• Council on Foreign Relations — Six Reasons Claude Mythos Is an Inflection Point
• GovTech / SANS Institute — New Report Details How Mythos AI Makes Cybersecurity Harder
• Penligent — Claude Code Source Map Leak: What Was Exposed and What It Means
• Escape Security — Apple’s App Store Source Map Leak: Found in 70% of Organisations
• Sentry Security Blog — Abusing Exposed Sourcemaps
• Expert Insights — Patch Management Statistics and Trends 2025 (Adaptiva Report)
• DeepStrike — Vulnerability Statistics 2025: Record CVEs and Exploitation
• Barracuda — Cybersecurity Awareness Month: Time for a reminder about your vulnerability backlog
• Cobalt — Top Cybersecurity Statistics for 2026 (CrowdStrike / QBE data)
• Bloomberg — Unauthorized Users Access Anthropic’s Restricted Mythos Model (April 21, 2026)
• TechCrunch — Unauthorized group has gained access to Anthropic’s exclusive cyber tool Mythos, report claims (April 21, 2026)
• The Next Web — Unauthorized users gained access to Anthropic’s restricted Mythos AI model (April 21, 2026)
• Euronews — Hackers breach Anthropic’s ‘too dangerous to release’ Mythos AI model, report (April 22, 2026)
