Anthropic's Unreleased Claude Mythos Preview Finds 10,000+ Vulnerabilities in One Month
Anthropic's unreleased Claude Mythos Preview model has discovered more than 10,000 vulnerabilities across partner organizations in its first month of deployment through Project Glasswing. The company reports partners are finding bugs at 10x their previous rate, with Cloudflare discovering 2,000 bugs and Mozilla finding 271 Firefox vulnerabilities — 10x more than with previous Claude models.
Anthropic's Unreleased Claude Mythos Preview Finds 10,000+ Vulnerabilities in One Month
Anthropic's unreleased Claude Mythos Preview model has discovered more than 10,000 vulnerabilities across partner organizations in the first month since launching Project Glasswing in April 2026, according to the company's initial report published May 23.
Deployment Results
According to Anthropic, most Project Glasswing partners have "each found hundreds of critical- or high-severity vulnerabilities in their software" using Mythos Preview. The company claims partners' bug-finding rates have increased by more than 10x:
- Cloudflare: 2,000 bugs total, 400 classified as high or critical severity
- Mozilla: 271 vulnerabilities in Firefox, 10x more than found in an older browser version using another Claude model
- Microsoft: Bug discoveries via Mythos Preview are reportedly why the company announced patch releases will "continue trending larger for some time"
Anthropic also scanned 1,000 open-source projects over recent months using Mythos Preview, identifying 6,202 high- and critical-severity vulnerabilities out of 23,019 total findings.
A security research firm recently claimed it used Mythos' bug-finding capabilities to breach macOS, though Anthropic did not include this in its official report.
Why Mythos Preview Remains Unreleased
Anthropic states it has not released Mythos Preview publicly because "no company (including itself) has developed safeguards strong enough to prevent models like it from being misused." The company intends to release "Mythos-class models" when adequate safeguards become available.
Current Project Glasswing partners include Amazon Web Services, Apple, CrowdStrike, Google, JPMorgan Chase, NVIDIA, Palo Alto Networks, Cloudflare, Mozilla, and Microsoft. Anthropic plans to expand availability to US and other government partners.
Financial Context
According to The Wall Street Journal, Anthropic is on track to post $10.9 billion revenue with $559 million operating profit for the quarter ending June 2026, marking potential first-time profitability since its 2021 founding. The company does not expect sustained profitability in subsequent quarters due to planned investments in computing resources.
What This Means
Mythos Preview represents a capability level that Anthropic considers too dangerous for public release — a rare acknowledgment that a model's offensive security capabilities outpace available defensive safeguards. The 10x improvement in partner bug-finding rates, if sustained, could significantly alter vulnerability disclosure timelines and patch cycles across the software industry. The government partnership expansion suggests cybersecurity applications may drive near-term AI model restrictions more than misinformation or other commonly cited risks.
Related Articles
Anthropic SDK v0.124.0 Moves Files and Skills APIs to General Availability, Adds Computer Use and Browser Use Toolsets
Anthropic released v0.124.0 of its Python SDK, graduating the Files and Skills APIs to general availability and introducing new computer use and browser use toolsets. The release is available now on GitHub.
Anthropic Claims Claude Agents Beat Industry Hit Rates in Autonomous Protein Design Trials
Anthropic published two experiments showing Claude models autonomously running open-source protein design software end-to-end, claiming hit rates of 26.8% against an industry baseline of 10-15%. Independent verification of the results is still pending.
Anthropic Expands Claude Cowork to Mobile for All Paid Plans
Anthropic announced that Claude Cowork, its workspace-focused feature, is now available on mobile and web for all paid plans. The rollout began last month exclusively on Anthropic's most expensive tier before expanding today.
Anthropic Adds Statistical Watermark to Claude Output, Drawing Quality and Legal Concerns
Anthropic is embedding a statistical watermark in Claude's text output, based on Google's SynthID-Text method, to comply with EU AI Act rules. Critics argue the technique degrades word choice quality, while legal analysts warn it could create new disclosure headaches for law firms.
Comments
Loading...