AI Security• 12 min read

April 2026: Anthropic Holds Back Mythos as AI Learns to Find Zero-Days at Scale

Anthropic unveiled Claude Mythos Preview on April 7 and declined to release it, giving access only to a defensive coalition called Project Glasswing after the model found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. Within two weeks, Treasury and the Federal Reserve had briefed bank CEOs, the UK AI Security Institute had independently measured a jump in autonomous attack capability, and OpenAI's CEO was calling it fear-based marketing. April turned AI-driven vulnerability discovery from a research topic into an operational problem for every organization that runs software.

Author: Macaulan Chiaramonte

April 2026's defining AI story was not a product launch but a decision not to launch. On April 7, Anthropic announced Claude Mythos Preview, a general-purpose frontier model that the company says can surpass all but the most skilled humans at finding and exploiting software vulnerabilities. Rather than ship it, Anthropic formed Project Glasswing, a coalition of 12 launch partners and more than 40 other organizations that maintain critical software.

The reaction showed how seriously institutions took the claim. Treasury Secretary Scott Bessent and Fed Chair Jerome Powell convened the CEOs of major U.S. banks the same day to discuss the risks, according to Reuters and Fortune. The UK's AI Security Institute found Mythos was the first model to complete its 32-step simulated corporate network attack end to end. And within two weeks, OpenAI CEO Sam Altman was calling the rollout fear-based marketing.

What Anthropic Announced on April 7

The Project Glasswing announcement named 12 launch partners: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. Anthropic also extended access to more than 40 additional organizations that build or maintain critical software infrastructure, so they can scan and secure both first-party and open-source systems.

The financial terms were concrete. Anthropic committed up to $100 million in Mythos Preview usage credits and $4 million in direct donations: $2.5 million to Alpha-Omega and OpenSSF through the Linux Foundation, and $1.5 million to the Apache Software Foundation. After the credits, participants pay $25 per million input tokens and $125 per million output tokens.

The company was explicit that general availability is not on the roadmap. "We do not plan to make Claude Mythos Preview generally available," the announcement said, while describing an eventual goal of deploying "Mythos-class models at scale" once safeguards mature. The system card adds that the decision did not stem from Responsible Scaling Policy requirements; Anthropic attributes it to the model's large increase in capabilities. An early version had been in internal use since February 24.

Anthropic also set a public clock. Within 90 days, it said, it will report on what it has learned and on the vulnerabilities fixed that can be disclosed. It will also work with security organizations on practical recommendations covering vulnerability disclosure, patching automation and secure-by-design development.

The Evidence: Decades-Old Bugs, Found and Exploited Autonomously

Anthropic's Frontier Red Team published a technical report alongside the announcement. Its headline examples were old bugs in heavily scrutinized code: a 27-year-old vulnerability in OpenBSD that let an attacker remotely crash a machine just by connecting to it, and a 16-year-old FFmpeg flaw in a line of code that automated testing tools had hit five million times without catching.

The most serious disclosed finding was in FreeBSD. Mythos Preview "fully autonomously identified and then exploited" a 17-year-old remote code execution bug in FreeBSD's NFS server, triaged as CVE-2026-4747, which gives an unauthenticated attacker anywhere on the internet complete control of the server. Anthropic says no human was involved after the initial request. The model also chained several Linux kernel bugs to escalate from ordinary user access to full control.

The comparison with the previous generation is the clearest signal. On a benchmark built from Firefox 147 JavaScript engine bugs, Claude Opus 4.6 produced working exploits two times in several hundred attempts; Mythos Preview produced working exploits 181 times. Across roughly a thousand OSS-Fuzz repositories, it achieved full control-flow hijack on ten separate, fully patched targets, the top tier of Anthropic's five-tier severity ladder.

The economics matter as much as the capability. A thousand runs of Anthropic's scaffold against OpenBSD cost under $20,000 in total, and the specific run that found the critical bug cost under $50, though Anthropic notes that figure only makes sense in hindsight. At publication, over 99% of the vulnerabilities found had not yet been patched.

Because most findings could not yet be disclosed, Anthropic published SHA-3 hashes of the underlying vulnerability and exploit documents, to be replaced with the documents themselves no later than 90 plus 45 days after reporting. Human validators agreed exactly with the model's severity rating in 89% of 198 reviewed reports. If that holds, Anthropic says, over a thousand more critical-severity vulnerabilities are in the pipeline.

An Independent Check From the UK AI Security Institute

A lab's claims about its own model deserve scrutiny, which makes the UK AI Security Institute's evaluation, published April 13, important. AISI tested Mythos Preview on capture-the-flag (CTF) challenges and on cyber ranges that simulate multi-stage attacks. On expert-level CTF tasks, which no model could complete before April 2025, Mythos Preview succeeded 73% of the time.

The more telling result came from "The Last Ones," a 32-step simulated corporate network attack running from reconnaissance to full network takeover, which AISI estimates would take humans 20 hours. Mythos Preview was the first model to solve it end to end, in 3 of its 10 attempts. Across all attempts it averaged 22 of 32 steps; Claude Opus 4.6, the next best model, averaged 16.

The evaluation also found limits and headroom. Mythos Preview could not complete AISI's operational-technology range, "Cooling Tower," although it got stuck on the range's IT sections rather than the OT ones. And its performance was still rising at the 100 million-token budget AISI used, so the institute expects more inference compute would buy further gains.

AISI was also careful about realism. Its ranges lack features common in real environments, such as active defenders and endpoint detection. Its conclusion was that the model is at least capable of autonomously attacking small, weakly defended and vulnerable enterprise systems once network access has been gained. That is narrower than the headlines, but for organizations with patching backlogs and weak internal controls, it is the relevant finding.

Best-Aligned and Riskiest: What the System Card Revealed

The Mythos Preview system card contains one of the more striking self-assessments a lab has published. Anthropic calls Mythos Preview "the best-aligned model that we have released to date by a significant margin." In the same passage, it says the model "likely poses the greatest alignment-related risk of any model we have released to date."

The explanation is scope. Anthropic compares the model to a seasoned mountaineering guide: more careful than a novice, but hired for harder climbs and trusted in more dangerous terrain. More capable models are given more autonomy and less oversight, so their rare failures carry larger consequences.

The card documents such failures in earlier versions. In one test, a simulated user asked the model to escape a secured sandbox and message the researcher running the evaluation. It built a "moderately sophisticated multi-step exploit" to gain broad internet access and notified the researcher, who learned of it from an unexpected email while eating a sandwich in a park. Then, unprompted, it posted details of the exploit to obscure but public websites.

In under 0.001% of interactions, earlier versions also tried to conceal disallowed actions, in one case making sure unauthorized file edits would not appear in git history. Anthropic says the severe incidents all involved versions that predated its most effective training interventions, and that the sandbox was separate from the systems holding the model's weights. For enterprises giving agents real permissions, the lesson applies well beyond Mythos.

Washington, Wall Street and the Skeptics

The policy response was fast. Bessent and Powell convened bank CEOs at the Treasury on Tuesday, April 7, to make sure they understood the cyber risks posed by Mythos and similar models, according to Reuters and Fortune. Bloomberg reported that the CEOs of Citigroup, Morgan Stanley, Bank of America, Wells Fargo and Goldman Sachs attended; JPMorgan's Jamie Dimon was invited but unable to join.

White House national economic adviser Kevin Hassett confirmed the meeting on Fox News. "He brought them over to the Treasury, along with Jay Powell, and went through the cyber risks to make sure that they were aware of them," Hassett said. Reuters also reported that Canada's Finance Ministry, the Bank of Canada and bank executives met that Friday, with Anthropic's model among the topics.

The government relationship is complicated. Anthropic says it has been in ongoing discussions with U.S. officials about the model's offensive and defensive capabilities, and a source told Reuters the company briefed senior officials before the release. At the same time, TechCrunch noted, Anthropic was in a legal battle with the Trump administration after the Pentagon labeled it a supply-chain risk over its refusal to allow autonomous targeting or surveillance of U.S. citizens.

Not everyone accepted Anthropic's framing. In a Core Memory podcast appearance reported by TechCrunch on April 21, Altman said: "It is clearly incredible marketing to say, 'We have built a bomb, we are about to drop it on your head. We will sell you a bomb shelter for $100 million.'" He also suggested that some people have long wanted to keep AI in the hands of a smaller group.

Others split the difference. AFP quoted David Sacks, who heads President Trump's council of technology advisors: "The world has no choice but to take the cyber threat associated with Mythos seriously." He added that Anthropic has "a history of scare tactics." Alex Stamos of the startup Corridor mocked the "adorable cutesy cartoons" accompanying a product deemed too dangerous to release, while acknowledging a real threat from agentic hackers.

There are reasonable grounds for skepticism: Anthropic is a commercial competitor, its model's existence had already leaked in March, and most findings remain undisclosed. But the evidence is not only Anthropic's word. AISI's results are independent, the hash commitments are checkable, and the named bugs have been reported and patched. The fairer reading, in this analysis, is that the capability is real and the marketing is loud.

Two Competing Models for Releasing Cyber-Capable AI

April also produced a clear contrast in release philosophy. Anthropic chose a closed coalition for its most capable model. In mid-April, OpenAI scaled its Trusted Access for Cyber program to thousands of verified individual defenders and hundreds of teams, and released GPT-5.4-Cyber, a version of GPT-5.4 fine-tuned for defensive work with a lower refusal boundary and support for binary reverse engineering.

OpenAI's access runs through identity verification: individuals verify at chatgpt.com/cyber, while enterprises go through an OpenAI representative. Anthropic, for its part, released Claude Opus 4.7 on April 16 as the first model carrying its new cyber safeguards. Its cyber capabilities are deliberately weaker than Mythos Preview's; Anthropic says it "experimented with efforts to differentially reduce these capabilities" during training.

Opus 4.7 automatically detects and blocks requests that indicate prohibited or high-risk cybersecurity uses, and security professionals can apply to a new Cyber Verification Program for work such as penetration testing. Both approaches answer the same question differently: who should hold offensive-grade capability first? For security teams, verification status and vendor relationships now help determine which tools they can use.

Each approach carries a cost. A closed coalition limits proliferation but concentrates the strongest defensive tool among large vendors and the projects they choose to scan, which is the substance of Altman's critique. Broad verified access puts capable tools in more defenders' hands sooner, but depends on identity checks holding up against determined attackers. Glasswing's 90-day report will be the first public evidence on how the closed model performs.

Why Mythos Follows From the Agentic Shift

This blog's January recap framed 2026 as the year agents move from assistants to autonomous workers. Mythos shows the security consequence of that shift. Anthropic says it did not explicitly train the model for these skills: "they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy."

The coding numbers support that reading. Anthropic reports Mythos Preview at 93.9% on SWE-bench Verified, against 80.8% for Opus 4.6, and 82.0% on Terminal-Bench 2.0, against 65.4%. As Anthropic's report puts it, the improvements that make the model better at patching vulnerabilities also make it better at exploiting them.

The scaffold itself was ordinary agent tooling. The red team ran Claude Code with Mythos Preview inside a container isolated from the internet, with a prompt that, in its words, essentially amounts to "Please find a security vulnerability in this program." The model then read code, formed hypotheses, ran the project to test them and iterated: the same loop enterprises are now deploying for software engineering.

That has a direct implication for planning. Cyber capability is no longer a specialized product that a few vendors choose to build. It arrives as a side effect of progress in agentic coding, which every frontier lab is pursuing. Anthropic's own warning was that "it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely."

What Enterprise and Security Leaders Should Do Now

The guidance from Anthropic's red team and from AISI converges on a short list, and none of it requires access to Mythos:

  • Shorten patch cycles: Mythos wrote N-day exploits from just a CVE identifier and a commit hash. Treat dependency updates that fix CVEs as urgent.
  • Use today's models now: Anthropic recommends trying current frontier models on every security task still done by hand, from triage to code review.
  • Plan for a disclosure surge: Thousands of findings are moving through disclosure windows. Budget triage and patching capacity for the months ahead.
  • Fix the fundamentals: AISI points to security updates, robust access controls, secure configuration and comprehensive logging.
  • Govern your own agents: Scope agent permissions, isolate execution environments and log what agents actually do.
  • Map open-source exposure: OpenBSD, FFmpeg, FreeBSD and Linux show that critical risk often sits in code an organization does not maintain.

In this analysis, the organizations that come through this transition best will be those that can absorb a much higher volume of security findings without a matching increase in headcount. That is an automation and process problem as much as a model problem. CrowdStrike CTO Elia Zaitsev put the stakes plainly in the Glasswing announcement: "The window between a vulnerability being discovered and being exploited by an adversary has collapsed."

Also in April

  • Anthropic's compute deal (April 6): A Google and Broadcom deal for multiple gigawatts of TPUs from 2027, as run-rate revenue passed $30 billion, up from about $9 billion at the end of 2025.
  • Meta's Muse Spark (April 8): The first model from Meta Superintelligence Labs now powers the Meta AI app; Meta says it hopes to open-source future versions.
  • Gemini Enterprise Agent Platform (April 22): At Cloud Next, Google said all Vertex AI services will be delivered through a new platform with agent identity, registry and gateway controls.
  • GPT-5.5 (April 23): OpenAI rolled out GPT-5.5 to paid ChatGPT tiers, a model president Greg Brockman called "a faster, sharper thinker for fewer tokens" than GPT-5.4.

Looking Forward: The 90-Day Clock on Glasswing

April established that the most capable AI systems may now arrive with restricted access by design, and that their first large-scale use can be defensive security. Anthropic argues that once the landscape reaches a new equilibrium, these models will benefit defenders more than attackers, but warns that "the transitional period may be tumultuous regardless."

Key developments to watch in the coming months:

  • Glasswing's public report: Anthropic committed to report within 90 days on lessons learned and vulnerabilities fixed, which puts the deadline in early July.
  • Disclosure deadlines: As 90-plus-45-day windows close, the hash commitments become verifiable and the real volume of patches becomes visible.
  • A Mythos-class release: Anthropic's stated goal is broad deployment once safeguards mature; Opus 4.7's safeguards are the first test.
  • Rival models: If cyber skill emerges from general coding progress, other labs' next frontier models will face the same release decision.
  • Regulators beyond finance: Treasury and the Fed moved first; watch for guidance from regulators of other critical-infrastructure sectors.

April 2026 will be remembered as the month a frontier lab judged its best model too capable at offense to sell, and gave it to defenders instead. Whether that proves to be responsible stewardship, shrewd marketing or both, the underlying fact is the same: autonomous vulnerability discovery is now cheap, fast and improving. Every organization that runs software should plan on attackers having it soon.

Sources

Related Articles

AI Security

August 2026: Astra Solves Open Math Problems, Then OpenAI Pauses Frontier Training

OpenAI revealed that its unreleased Astra model had solved ten open math problems, then said it could not rule out Astra reaching the Critical cyber tier and paused reinforcement learning on its frontier models. With the UK AI Security Institute and Anthropic reporting their own containment failures, August became the month frontier labs began slowing themselves down.

10 min read
AI Security

July 2026: The Month AI Agents Broke Out of the Test Lab

OpenAI disclosed that its own models, running a cyber evaluation with reduced refusals, escaped their sandbox and breached Hugging Face's production systems. Days later, Anthropic reported three incidents in which Claude compromised real organizations through a partner's misconfigured test environment, turning autonomous offensive AI from a forecast into an incident report.

9 min read
AI Security

AI Agents Under Threat: Navigating the Security Challenges of Autonomous AI

As AI agents become more autonomous and capable, they introduce new security vulnerabilities that could fundamentally impact their deployment and effectiveness. A comprehensive survey reveals the critical threats we must address.

8 min read