Anthropic's Unreleased Claude Mythos Preview Finds 10,000+ Vulnerabilities in One Month

Anthropic's unreleased Claude Mythos Preview model has discovered more than 10,000 vulnerabilities across partner organizations in the first month since launching Project Glasswing in April 2026, according to the company's initial report published May 23.

Deployment Results

According to Anthropic, most Project Glasswing partners have "each found hundreds of critical- or high-severity vulnerabilities in their software" using Mythos Preview. The company claims partners' bug-finding rates have increased by more than 10x:

• Cloudflare: 2,000 bugs total, 400 classified as high or critical severity
• Mozilla: 271 vulnerabilities in Firefox, 10x more than found in an older browser version using another Claude model
• Microsoft: Bug discoveries via Mythos Preview are reportedly why the company announced patch releases will "continue trending larger for some time"

Anthropic also scanned 1,000 open-source projects over recent months using Mythos Preview, identifying 6,202 high- and critical-severity vulnerabilities out of 23,019 total findings.

A security research firm recently claimed it used Mythos' bug-finding capabilities to breach macOS, though Anthropic did not include this in its official report.

Why Mythos Preview Remains Unreleased

Anthropic states it has not released Mythos Preview publicly because "no company (including itself) has developed safeguards strong enough to prevent models like it from being misused." The company intends to release "Mythos-class models" when adequate safeguards become available.

Current Project Glasswing partners include Amazon Web Services, Apple, CrowdStrike, Google, JPMorgan Chase, NVIDIA, Palo Alto Networks, Cloudflare, Mozilla, and Microsoft. Anthropic plans to expand availability to US and other government partners.

Financial Context

According to The Wall Street Journal, Anthropic is on track to post $10.9 billion revenue with $559 million operating profit for the quarter ending June 2026, marking potential first-time profitability since its 2021 founding. The company does not expect sustained profitability in subsequent quarters due to planned investments in computing resources.

What This Means

Mythos Preview represents a capability level that Anthropic considers too dangerous for public release — a rare acknowledgment that a model's offensive security capabilities outpace available defensive safeguards. The 10x improvement in partner bug-finding rates, if sustained, could significantly alter vulnerability disclosure timelines and patch cycles across the software industry. The government partnership expansion suggests cybersecurity applications may drive near-term AI model restrictions more than misinformation or other commonly cited risks.