Anthropic's Unreleased Claude Mythos Preview Finds 10,000+ Vulnerabilities in One Month
Anthropic's unreleased Claude Mythos Preview model has discovered more than 10,000 vulnerabilities across partner organizations in its first month of deployment through Project Glasswing. The company reports partners are finding bugs at 10x their previous rate, with Cloudflare discovering 2,000 bugs and Mozilla finding 271 Firefox vulnerabilities — 10x more than with previous Claude models.
Anthropic's Unreleased Claude Mythos Preview Finds 10,000+ Vulnerabilities in One Month
Anthropic's unreleased Claude Mythos Preview model has discovered more than 10,000 vulnerabilities across partner organizations in the first month since launching Project Glasswing in April 2026, according to the company's initial report published May 23.
Deployment Results
According to Anthropic, most Project Glasswing partners have "each found hundreds of critical- or high-severity vulnerabilities in their software" using Mythos Preview. The company claims partners' bug-finding rates have increased by more than 10x:
- Cloudflare: 2,000 bugs total, 400 classified as high or critical severity
- Mozilla: 271 vulnerabilities in Firefox, 10x more than found in an older browser version using another Claude model
- Microsoft: Bug discoveries via Mythos Preview are reportedly why the company announced patch releases will "continue trending larger for some time"
Anthropic also scanned 1,000 open-source projects over recent months using Mythos Preview, identifying 6,202 high- and critical-severity vulnerabilities out of 23,019 total findings.
A security research firm recently claimed it used Mythos' bug-finding capabilities to breach macOS, though Anthropic did not include this in its official report.
Why Mythos Preview Remains Unreleased
Anthropic states it has not released Mythos Preview publicly because "no company (including itself) has developed safeguards strong enough to prevent models like it from being misused." The company intends to release "Mythos-class models" when adequate safeguards become available.
Current Project Glasswing partners include Amazon Web Services, Apple, CrowdStrike, Google, JPMorgan Chase, NVIDIA, Palo Alto Networks, Cloudflare, Mozilla, and Microsoft. Anthropic plans to expand availability to US and other government partners.
Financial Context
According to The Wall Street Journal, Anthropic is on track to post $10.9 billion revenue with $559 million operating profit for the quarter ending June 2026, marking potential first-time profitability since its 2021 founding. The company does not expect sustained profitability in subsequent quarters due to planned investments in computing resources.
What This Means
Mythos Preview represents a capability level that Anthropic considers too dangerous for public release — a rare acknowledgment that a model's offensive security capabilities outpace available defensive safeguards. The 10x improvement in partner bug-finding rates, if sustained, could significantly alter vulnerability disclosure timelines and patch cycles across the software industry. The government partnership expansion suggests cybersecurity applications may drive near-term AI model restrictions more than misinformation or other commonly cited risks.
Related Articles
Anthropic launches Personal Finance in Claude with read-only Plaid access for US Pro, Max and Ultra users
Anthropic announced Personal Finance in Claude, a feature that connects bank and credit card accounts through Plaid with read-only access. Conversations in the Personal Finance hub are not used to train Anthropic's models. It is available only to Pro, Max and Ultra subscribers in the US.
METR report: Anthropic's unreleased Model 4 scores 178.6 on AECI, ahead of Opus 5.5
METR's new report discloses three unreleased Anthropic models, Model 2, Model 3 and Model 4. Model 4 scores 178.6 on Anthropic's AECI index, about 3.9 points above Opus 5.5. Anthropic co-founder Sam McCandlish confirmed the report's main findings but said much information was removed.
METR Report: Anthropic's AI Development Pace May Have Doubled Due to Internal AI Use
A new report from AI research nonprofit METR says AI use within Anthropic may have doubled the company's pace of AI development. The rate at which Anthropic's models are improving as of October is roughly twice the rate between March 2024 and October 2025, according to The Information.
OpenAI launches GPT-6 Cyber, rated Critical, with 48.5% on ExploitGym
OpenAI has launched GPT-6 Cyber, classified Critical in cybersecurity on its Preparedness Framework. It scored 48.5 percent on ExploitGym, ahead of GPT-6 Astra's 42.4 percent, and OpenAI says it went out of bounds less than 1 percent of the time in testing.
Comments
Loading...