Anthropic’s Claude Mythos & Project Glasswing: The AI Too Dangerous to Release | NeuralWired
NeuralWiredFrontier Intelligence for the People Who Build Tomorrow
You’re reading NeuralWired — the publication built for technologists, CISOs, investors, and operators who can’t afford to be surprised by frontier AI. This piece is part of our ongoing series on AI Safety & Cyber Intelligence. For weekly briefings on what matters before everyone else covers it, subscribe to The Neural Loop.
Breaking Analysis · AI Cybersecurity · April 10, 2026
The AI Too Dangerous to Release Just Found Zero-Days in Every Major OS — Here’s What That Means for Your Security
Claude Mythos Preview autonomously discovered thousands of high-severity vulnerabilities before Anthropic locked it away. Project Glasswing gives 50+ organizations early access. Everyone else gets a ticking clock.
Trending AnalysisBy NeuralWired Editorial~2,200 words · 9 min readSources: Anthropic, Fortune, CrowdStrike, JPMorganChase, CoreWeave
93.9%
SWE-bench Verified score — Mythos Preview
27yrs
Age of oldest bug Mythos uncovered — OpenBSD
$100M
Compute credits Anthropic committed to Project Glasswing
On April 7, 2026, Anthropic published a blog post that most security teams hadn’t fully absorbed by the time it went viral. The headline: an AI model they built — and chose not to release — had independently found thousands of critical vulnerabilities hiding in software that runs the internet, every major operating system, and every major browser. Some of those bugs had been sitting there for decades, surviving millions of automated fuzz tests and years of human review.
The model is called Claude Mythos Preview. The initiative using it is called Project Glasswing. And understanding what both of these mean — not just for Anthropic, but for every organization that depends on software — is quickly becoming a baseline competency for any security leader.
What Anthropic’s Claude Mythos Actually Is
Mythos Preview is Anthropic’s most capable model by a considerable margin — and, crucially, the first frontier AI model any major lab has explicitly withheld from public release because of what it can do. This isn’t a safety decision born of ambiguity. It’s a deliberate choice backed by a stark internal assessment.
According to Anthropic’s own Project Glasswing documentation, Mythos represents a model that is presently far ahead of any other AI in cyber capabilities and presages an era in which AI models can find and exploit vulnerabilities “in ways that far outpace the efforts of defenders.” That language, which appeared in Anthropic’s internal communications before the public announcement, is what triggered stock volatility across major cybersecurity vendors — CrowdStrike, Palo Alto Networks, SentinelOne, and others — when it began circulating in March.
Mythos isn’t a specialized security scanner. It’s a frontier language model whose advanced agentic coding and reasoning capabilities happen to translate with frightening effectiveness into autonomous vulnerability discovery. Give it access to a codebase and a single prompt, and it can identify subtle logic flaws, construct working exploit chains, and document everything — without requiring human steering at each step.
Why this matters beyond cybersecurity: Mythos demonstrates that the gap between “AI that helps you code” and “AI that can systematically break any software it touches” is smaller than the industry assumed. That asymmetry — offense scaling faster than defense — is the core challenge Project Glasswing is trying to answer.
What It Found — And Why That Keeps CISOs Up at Night
The specific vulnerabilities Mythos uncovered aren’t just impressive in aggregate. The type of bugs it found tells you something important about the limits of conventional security tooling.
Consider: a 27-year-old vulnerability in OpenBSD that allowed remote machines to crash. A 16-year-old out-of-bounds write in FFmpeg that automated fuzz testing had touched over 5 million times without flagging. A 17-year-old unauthenticated remote root privilege in FreeBSD (CVE-2026-4747). Multiple Linux kernel vulnerabilities that Mythos chained together to escalate from user-level access to full system control. These weren’t obscure corner cases. They were in widely deployed software that billions of systems depend on.
As Salt Data’s security analysis documented, the FFmpeg finding is particularly instructive. The bug had survived extensive automated testing precisely because discovering it required semantic understanding of intent — what the code was trying to do — not just syntactic pattern matching. Mythos brought that understanding.
“The window between a vulnerability being discovered and being exploited by an adversary has collapsed — what once took months now happens in minutes with AI. Claude Mythos Preview demonstrates what is now possible for defenders at scale, and adversaries will inevitably look to exploit the same capabilities. That is not a reason to slow down; it’s a reason to move together, faster.”
— Elia Zaitsev, CTO, CrowdStrike · Anthropic Project Glasswing blog
The strategic implication Zaitsev is pointing at is the one that should drive your board conversation: the question isn’t whether adversaries will eventually access Mythos-class capabilities. It’s whether your organization will be patched, hardened, and instrumented before they do.
The Benchmarks: Quantifying the Capability Jump
Anthropic published direct benchmark comparisons between Mythos Preview and Claude Opus 4.6 — currently their top publicly available model. The gap is substantial across every relevant dimension.
The CyberGym gap (+16.5 points) is the one that matters most for security practitioners. It measures a model’s ability to reproduce known cybersecurity vulnerabilities from documentation — a proxy for how effectively it can understand, replicate, and potentially construct exploit paths. Mythos at 83.1% isn’t just better than Opus 4.6. It’s operating in a different category.
All benchmarks were run internally by Anthropic. No independent replication exists yet, which is a genuine caveat. But the real-world findings — decades-old zero-days in production codebases — function as an external validation that words in a benchmark table can’t fully capture.
Project Glasswing: The Coalition Holding the Keys
Anthropic’s response to having built something it judges too dangerous for public release isn’t to shelve it. It’s to run a structured, gated access program that uses Mythos’ capabilities defensively — finding and patching vulnerabilities in critical infrastructure before adversaries discover them independently.
That program is Project Glasswing. The initial partner coalition includes some of the most significant institutions in global technology and finance:
Amazon Web ServicesAppleBroadcomCiscoCrowdStrikeGoogleJPMorganChaseLinux FoundationMicrosoftNVIDIAPalo Alto Networks40+ Critical Infra Orgs
“We’ve been testing Claude Mythos Preview in our own security operations, applying it to critical codebases, where it’s already helping us strengthen our code. We’re bringing deep security expertise to our partnership with Anthropic and are helping to harden Claude Mythos Preview so even more organizations can advance their most ambitious work with security that sets the standard.”
— Amy Herzog, VP & CISO, Amazon Web Services · Anthropic Glasswing blog
Beyond model access, Anthropic is committing up to $100M in usage credits to Glasswing partners, plus $4M in direct donations — $2.5M to Alpha-Omega and OpenSSF through the Linux Foundation, $1.5M to the Apache Software Foundation — to fund open-source security infrastructure. These donations aren’t symbolic. They fund the maintainer capacity needed to process and patch AI-generated vulnerability reports.
The financial angle matters too. On April 10, 2026 — three days after the Glasswing announcement — CoreWeave and Anthropic announced a multi-year GPU infrastructure agreement to support Claude’s production deployment at scale. CoreWeave reported $5.13B in 2025 revenue with guidance for over $12B in 2026 and a contracted backlog exceeding $66B. Mythos-class workloads don’t run on commodity hardware, and the infrastructure commitments signal that Anthropic is building for sustained operation at frontier scale — not a one-off research demo.
Risk Matrix: What Mythos-Class AI Means for Your Threat Model
If Mythos-class capabilities reach adversaries — whether through model weight leakage, independent development by well-funded state actors, or gradual proliferation as the capability ceiling rises across the industry — the following risks move from theoretical to near-certain. Here’s how to prioritize them.
CriticalAI-accelerated zero-day discovery
Models that scan codebases autonomously compress discovery timelines from months to hours. Every major OS and browser is exposed. Patch cycles become the primary survival variable.
CriticalAutonomous exploit chaining
Mythos didn’t just find individual bugs — it chained multiple Linux kernel vulnerabilities into a privilege escalation path. AI-driven lateral movement becomes real-time.
HighOpen-source supply chain exposure
The FFmpeg and OpenBSD findings demonstrate that widely deployed OSS carries latent risk that conventional tooling misses. Every downstream dependency is a potential vector.
HighUnmanageable vuln backlogs
If your team can’t patch faster than AI can find and report issues, you’re accumulating disclosed liability. AI discovery without AI-assisted triage creates a new failure mode.
MediumModel access leakage
Gated access programs can leak via insider misuse, prompt extraction, or model weight exfiltration. Current public docs don’t detail Glasswing’s mitigations for this.
MediumRegulatory and compliance friction
Anthropic proactively briefed governments on Mythos’ risks. Central banks and financial regulators are already evaluating systemic cyber-risk implications for large institutions.
The CISO Playbook: 30/90/365-Day Action Framework
You don’t need Mythos access to start hardening for a Mythos-class threat environment. Here’s a sequenced response.
Defensive Framework: AI Zero-Day Era
01
0–30 Days: Assess & Triage
Inventory your critical software, open-source dependencies, and highest-exposure services. Map your current vulnerability discovery pipeline — SAST, DAST, fuzzing, manual review — and identify where semantic understanding gaps exist. These are where Mythos-class systems will find what your tools missed. Check your patch SLA against realistic AI-accelerated exploitation timelines.
02
30–90 Days: Upgrade Detection & Response
Deploy AI-augmented code scanning in your CI/CD pipeline — tools that can reason semantically about code behavior, not just match known patterns. Evaluate whether you qualify for Glasswing-adjacent programs as they expand. Conduct tabletop exercises assuming AI-assisted adversaries. Tune your EDR and XDR stack for novel, AI-generated exploit signatures you’ve never seen in the wild before.
03
90–365 Days: Structural Hardening
Build AI-assisted red team capacity internally or through trusted partners. Implement rigorous SBOM tracking and dependency governance — supply chain exposure was central to Mythos’ most dramatic findings. Establish a board-level reporting cadence for AI cyber risk alongside traditional threat briefings. Push regulators for clarity on AI-generated vuln disclosure obligations before they mandate it.
04
Ongoing: Monitor & Participate
Track Glasswing disclosures and CVE publications linked to AI-discovered vulnerabilities as leading indicators. Participate in ISACs and AI-security working groups. Watch for Anthropic’s planned expansion of Mythos-class access as safeguards mature — the organizations that participated in early access programs historically built the deepest defensive expertise.
“AI capabilities have crossed a threshold that fundamentally changes the urgency required to protect critical infrastructure from cyber threats, and there is no going back. Our foundational work with these models has shown we can identify and fix security vulnerabilities across hardware and software at a pace and scale previously impossible. That is a profound shift, and a clear signal that the old ways of hardening systems are no longer sufficient.”
— Anthony Grieco, SVP & Chief Security & Trust Officer, Cisco · Anthropic Glasswing blog
The Contrarian View: Is This Defense or Theater?
Glasswing’s defenders-first framing has attracted real skepticism, and it deserves engagement rather than dismissal.
The first concern is structural. Concentrating Mythos access in a coalition of Big Tech companies and large financial institutions doesn’t just protect critical infrastructure — it entrenches it. Smaller enterprises, non-US organizations, academic researchers, and open-source communities without Fortune 500 relationships don’t get early access. The Mythos capability gap between Glasswing partners and everyone else may persist for years. Jim Zemlin of the Linux Foundation acknowledged this tension directly, framing Glasswing as a chance to give even resource-constrained maintainers an “AI-powered sidekick.” But early access remains concentrated at the top.
The second concern is practical: disclosure without patch capacity creates liability, not security. Mythos can find vulnerabilities faster than human teams can validate, triage, and fix them. If the AI-generated discovery backlog overwhelms the humans responsible for remediation, the net effect could be a larger disclosed attack surface — not a smaller one.
The third concern cuts to the core of the “defense-first” thesis itself. CrowdStrike’s Zaitsev and Palo Alto’s Lee Klarich both argue that adversaries will develop equivalent capabilities regardless, so the right move is to accelerate defenders. That logic is defensible but not closed. Capable state actors may already have models approaching Mythos-class performance, or they may be years away. The timeline assumption embedded in “move faster together” carries enormous strategic weight — and Anthropic hasn’t published it.
“Perhaps even more important: everyone needs to prepare for AI-assisted attackers.”
None of this makes Project Glasswing a bad idea. It makes it an incomplete answer to a problem that will outlast any single initiative. The organizations that treat Glasswing as a complete solution will be wrong. Those who treat it as the opening move in a longer defensive buildout are closer to right.
Frequently Asked Questions
Claude Mythos Preview is Anthropic’s most capable and currently unreleased frontier AI model, built with advanced agentic coding and reasoning capabilities that enable it to autonomously discover and exploit software vulnerabilities at scale. It outperforms Claude Opus 4.6 on every major coding and cybersecurity benchmark — including a 93.9% score on SWE-bench Verified — and has already found thousands of high-severity zero-days across every major OS and browser.
Anthropic determined that Mythos’ cyber capabilities are sufficiently advanced that general public release would materially increase the risk of large-scale AI-assisted cyberattacks. This makes Mythos the first frontier AI model explicitly withheld from public access for safety reasons. Access is restricted to vetted Project Glasswing partners for defensive vulnerability discovery while Anthropic develops safeguards sufficient for broader deployment.
Project Glasswing is Anthropic’s gated-access initiative that allows a curated coalition of technology, security, and critical-infrastructure organizations to use Claude Mythos Preview for proactive vulnerability discovery and patching. Partners include AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, plus more than 40 additional organizations. Anthropic is also committing up to $100M in compute credits and $4M in open-source security donations.
Mythos uses advanced semantic code understanding combined with agentic tool-use to analyze codebases autonomously, reason about developer intent, and identify flaws that pattern-matching tools miss. In documented cases, it found a 16-year-old FFmpeg vulnerability that had survived 5 million automated fuzz test passes, and chained together multiple Linux kernel flaws into a privilege escalation path — all without human steering at each step.
Mythos substantially outperforms Opus 4.6 across all measured dimensions: 93.9% vs 80.8% on SWE-bench Verified (code bug fixing), 83.1% vs 66.6% on CyberGym (vulnerability reproduction), and 82.0% vs 65.4% on Terminal-Bench 2.0 (agentic tool use). The CyberGym gap is the most significant for security practitioners — a +16.5 point difference suggests a qualitative shift in autonomous exploit capability.
In the near term: audit your open-source dependencies for vulnerabilities Mythos has flagged (watch for CVE disclosures tied to Glasswing), tighten patch SLAs to account for compressed exploitation windows, and evaluate AI-augmented code scanning for your CI/CD pipeline. For a full framework, see the 30/90/365-day playbook in this article.
Yes, in a specific way. JPMorganChase joined Glasswing partly in response to concerns about systemic financial risk from AI-accelerated cyberattacks. Anthropic proactively briefed government agencies on this risk before the public announcement. Financial institutions face both the direct technical threat (AI-found zero-days in banking infrastructure) and a regulatory risk as central banks and financial supervisors assess whether AI-enabled cyber events require new systemic risk frameworks.
Three main criticisms have emerged: (1) Access concentration — Glasswing primarily benefits large tech companies and financial institutions, leaving smaller organizations and non-US entities without early access or guidance; (2) Patch capacity bottlenecks — AI-generated vulnerability reports may exceed the human capacity to triage and fix them, creating disclosure liability without corresponding security improvements; (3) Timeline assumptions — the “move faster together” thesis assumes adversary development timelines that Anthropic hasn’t made public.
On April 10, 2026, CoreWeave and Anthropic announced a multi-year GPU infrastructure agreement to support Claude’s production deployment at scale. CoreWeave reported $5.13B in 2025 revenue with $12B+ guidance for 2026. This matters for Mythos specifically because frontier vulnerability discovery at scale requires significant compute — the infrastructure commitment signals that Anthropic is building for sustained operation of Mythos-class workloads, not a single demonstration run.
Anthropic has not published a timeline. Their stated plan is to expand Mythos-class access once safeguards are sufficiently mature to prevent misuse. Given the pace of capability development across the industry, most security analysts expect either Anthropic to widen Glasswing eligibility, or competing labs to approach similar capability levels, within 18–36 months. The more important question may be governance readiness, not model access.
What Comes Next
Project Glasswing and Claude Mythos Preview together represent something genuinely new: a frontier AI capability that a lab judged too dangerous to release, channeled through a structured coalition into a defensive mission. It’s not a perfect solution. The access concentration, patch capacity limits, and opacity around adversary timelines are real problems without clean answers.
But the deeper pattern here matters more than any individual model or program. Mythos demonstrates that the asymmetry between AI-powered offense and conventional defense has already moved beyond theoretical concern. The bugs it found weren’t edge cases — they were in software your infrastructure depends on today, and they’d been there for decades while the security industry ran its best tools past them millions of times. That changes the security calculus for every organization regardless of whether they ever touch Mythos.
Watch for three developments in the next 12–18 months: the pace at which CVEs tied to Glasswing disclosures appear in the public record (a proxy for how actively Mythos is being deployed); regulatory movement from financial supervisors treating AI-accelerated cyber risk as a systemic concern rather than an IT problem; and the emergence of competing initiatives from other frontier labs that will determine whether gated access models or open defensive deployments become the industry norm. The organizations building AI-augmented security operations now — before those norms solidify — will set the terms of what comes next.
Stay ahead of what’s building
NeuralWired covers the frontier AI stories that change decisions — for technologists, operators, and the people who fund them. Every week.
Disclaimer: This article is produced for informational and editorial purposes. NeuralWired has no commercial relationship with Anthropic, CoreWeave, or any Project Glasswing partner named herein. Benchmark data is sourced from Anthropic’s April 2026 Project Glasswing announcement and has not been independently replicated at time of publication. This article does not constitute cybersecurity, investment, or legal advice. Readers should consult qualified professionals before making organizational security decisions based on this or any other publication.
Anthropic’s Claude Mythos AI Model Preview: The Locked-Down Weapon Reshaping Cybersecurity in 2026 | NeuralWired
This analysis is published by NeuralWired, frontier intelligence for the professionals who build, fund, and govern technology’s future. For related coverage, see our AI Safety and Cybersecurity verticals.
AI Security
Anthropic’s Claude Mythos AI Model Preview: The Locked-Down Weapon Reshaping Cybersecurity in 2026
The most powerful AI model Anthropic has ever built can find zero-days in every major OS. You can’t have it. Here’s why that decision might be the most consequential thing in enterprise security this year.
Published: April 8, 2026Category: AI Security / Frontier ModelsRead time: 14 minutes
Anthropic’s Claude Mythos AI model preview can find a 27-year-old vulnerability in OpenBSD, a 16-year-old exploit in FFmpeg that had survived five million automated scans without detection, and a multi-flaw chain in the Linux kernel. It can do all of this autonomously. And you cannot have access to it.
That restriction is deliberate. Anthropic announced on April 7, 2026 that Claude Mythos Preview was its most powerful model yet, outperforming every earlier Claude iteration on coding, reasoning, and cybersecurity benchmarks by margins that security practitioners are calling a generational leap. The company simultaneously announced that it would not be releasing the model publicly.
Instead, Mythos has been reserved for a closed network of 11 founding partners and over 40 additional vetted organizations under a new initiative called Project Glasswing. The logic is straightforward and the stakes are extraordinary: a model this capable in the hands of the wrong actor could automate exploitation of critical infrastructure at a scale and speed that no human security team could outrun.
This analysis breaks down what Mythos actually is, what the benchmarks reveal, how Project Glasswing is structured, who already has access, and what every CISO, CTO, and security engineer needs to do before the end of 2026 regardless of whether they ever get near the model.
What is the Anthropic Mythos AI Model Preview?
Claude Mythos Preview is Anthropic’s description of it as “the most powerful AI model we’ve ever developed.” It supersedes Claude Opus 4.6 as Anthropic’s flagship frontier model and was developed with a specific focus on advanced code reasoning, agentic workflows, and cybersecurity vulnerability discovery.
The model operates autonomously across multi-step technical tasks. It can be given a codebase, binaries, or a system specification and it will scan for weaknesses, generate exploit proof-of-concept code, and propose patches without requiring a human to guide each step. That level of agentic capability distinguishes Mythos from earlier language models that could discuss security topics but could not execute against them.
Anthropic first began using Mythos internally in large-scale vulnerability hunts before the April announcement. The results were significant enough to warrant both a formal partner program and a decision not to release the model to the public. According to the Project Glasswing announcement, Mythos has already identified thousands of high-severity vulnerabilities across every major operating system and web browser. Those findings have been reported to software maintainers in a coordinated disclosure process.
The model carries an internal codename of “Capybara” according to community tracking, and details about its architecture first became public in March 2026 through a content management system misconfiguration that exposed pre-release documentation. The official announcement in April aligned with that leaked framing.
“AI capabilities have crossed a threshold that fundamentally changes the urgency required to protect critical infrastructure from cyber threats, and there is no going back.”
Anthony Grieco, SVP and Chief Security and Trust Officer, Cisco
Benchmark Dominance: The Numbers Behind the Hype
Vendor benchmark claims deserve scrutiny, and Anthropic’s case for Mythos rests on a suite of evaluations that covers coding, cybersecurity, general reasoning, and agentic task performance. The numbers, drawn from Anthropic’s Glasswing announcement and confirmed by the Mythos system card summary at NxCode, represent double-digit gains over the previous flagship in most categories.
Benchmark
Mythos Preview
Claude Opus 4.6
Delta
CyberGym (vulnerability reproduction)
83.1%
66.6%
+16.5 pts
SWE-bench Verified
93.9%
80.8%
+13.1 pts
SWE-bench Pro
77.8%
53.4%
+24.4 pts
Terminal-Bench 2.0
82.0%
65.4%
+16.6 pts
SWE-bench Multimodal
59.0%
27.1%
+31.9 pts
GPQA Diamond
94.6%
91.3%
+3.3 pts
Humanity’s Last Exam (no tools)
56.8%
40.0%
+16.8 pts
USAMO 2026
97.6%
N/A
New benchmark
BrowseComp (4.9x fewer tokens)
86.9%
83.7%
+3.2 pts
OSWorld-Verified
79.6%
72.7%
+6.9 pts
The most striking figures are in the coding categories. The 31-point lead on SWE-bench Multimodal and the 24-point jump on SWE-bench Pro reflect Mythos’s capacity to understand and act on code at a level that earlier models could approximate but not reliably execute. SWE-bench Pro targets professional-grade software engineering tasks, which maps more directly to real security work than sanitized benchmark conditions.
The CyberGym score deserves attention specifically because it measures vulnerability reproduction rather than theoretical knowledge. A score of 83.1% means that in four out of every five cases, Mythos was able to independently reproduce a known vulnerability from minimal starting information. At Opus 4.6’s 66.6%, that figure was already impressive for an AI system. The Mythos gap represents a fundamentally different operational posture.
“The window between a vulnerability being discovered and being exploited by an adversary has collapsed. What once took months now happens in minutes with AI.”
Elia Zaitsev, Chief Technology Officer, CrowdStrike
These benchmarks were run by Anthropic on its own infrastructure, which means independent replication has not yet occurred. That is a legitimate methodological caveat. But the case studies accompanying the Glasswing announcement, including the 27-year OpenBSD bug and the 16-year FFmpeg vulnerability, provide concrete evidence beyond benchmark scores. The FFmpeg flaw in particular had survived five million automated scans by existing tools without being flagged.
Project Glasswing and the Partner Coalition
Project Glasswing is the governance structure Anthropic built around Mythos to enable defensive use while limiting offensive exposure. Named after a transparent-winged butterfly, it functions as a vetted-access program that grants qualifying organizations the ability to run Mythos against their own codebases and infrastructure.
The 11 founding partners represent a cross-section of the technology and critical infrastructure landscape:
Amazon Web ServicesAppleBroadcomCiscoCrowdStrikeGoogleJPMorganChaseLinux FoundationMicrosoftNVIDIAPalo Alto Networks
Beyond those 11, more than 40 additional organizations that build or maintain critical software have received access for scanning their own first-party and open-source code. Anthropic has also committed up to $100 million in Mythos usage credits for Glasswing participants and $4 million in direct financial support to open-source security organizations, including $2.5 million to Alpha-Omega and the OpenSSF through the Linux Foundation, and $1.5 million to the Apache Software Foundation.
Partners can access Mythos through four channels: the Claude API directly, Google Cloud Vertex AI, Amazon Bedrock, and Microsoft Azure Foundry. After the credit period ends, pricing is set at $25 per million input tokens and $125 per million output tokens. Anthropic has committed to publishing a formal progress report within 90 days, covering vulnerabilities fixed and security improvements that can be publicly disclosed.
“By giving maintainers of critical open-source codebases access to a new generation of AI models that can proactively identify and fix vulnerabilities at scale, Project Glasswing offers a credible path to changing that equation.”
Jim Zemlin, CEO, The Linux Foundation
Why Anthropic Is Keeping Mythos Locked Down
The decision not to release Mythos publicly is not primarily a product strategy. It reflects a specific risk calculation that Anthropic describes explicitly in the Glasswing documentation: a model this capable at finding and exploiting software vulnerabilities is also a model that attackers would pay to access.
The threat model is not abstract. If a nation-state or ransomware syndicate had access to Mythos-class capabilities, they could automate zero-day discovery across widely deployed infrastructure at a scale that currently requires teams of elite researchers months to replicate manually. The FFmpeg vulnerability that survived 16 years of human and automated scanning is precisely the kind of target that AI-accelerated offense would identify faster than defenders could patch.
Anthropic’s Dianna Penn, Research Product Management Lead, described the decision to CNBC as “a preliminary move to provide numerous cyber defenders with an advantage on a subject that will grow increasingly vital.” That framing matters. The restriction is presented as temporary. Anthropic has indicated it is working on model-level safeguards that would allow a future Opus-class model to incorporate Mythos-level capabilities with guardrails sufficient to permit broader deployment.
What Anthropic is not doing is pretending that access controls alone solve the problem. The company acknowledged in its system card that Mythos presents a risk profile it considers too high for general release under current safety frameworks. That admission is more candid than typical vendor safety language and suggests that the internal debate about releasing the model was significant.
There is also an arms race logic buried in Glasswing’s structure. If defenders do not have access to the best available AI tools, attackers with equivalent or near-equivalent capabilities will find vulnerabilities faster than they can be patched. The partner coalition represents Anthropic’s attempt to get the most capable defenders access to the most capable tools before that gap opens.
The Enterprise Adoption Roadmap: A Five-Step Framework
Most enterprises are not in the Glasswing partner list. That creates a strategic planning question: what should you actually do now, and what should you be prepared for when Mythos-class capabilities become more broadly available?
1
2 to 3 weeks
Threat and asset mapping
Inventory your critical software assets, open-source dependencies, and current vulnerability management stack. Mythos’s documented value is greatest where legacy tools have failed, specifically long-lived bugs in widely trusted components. Without a ranked list of high-impact targets, deploying AI scanning tools generates noise rather than intelligence.
2
2 to 4 weeks
Vendor and access strategy
Engage account teams at AWS, Google Cloud, and Microsoft to understand your eligibility path for Glasswing participation. If direct access is unavailable, identify which existing security partners are integrating Mythos-class capabilities and begin evaluating how those integrations interact with your stack. Document contractual and data residency constraints before any pilot.
3
Parallel, 2 to 4 weeks
Governance and guardrails design
Define explicit policies for what any Mythos-adjacent tool can do within your environment: read-only code analysis, no production credentials, mandatory logging, and human review gates for any exploit proof-of-concept or patch recommendation. Restrict initial access to development mirrors and security sandboxes. Get written policy approved by security leadership before any test deployment begins.
4
4 to 8 weeks
Pilot deployment on high-value targets
Run the model on one to three high-value codebases or attack surfaces. Capture metrics that matter: vulnerabilities found, severity distribution, false positive rate, and time from identification to triage and patch. Compare these numbers against your current SAST, DAST, and bug bounty outputs. If Mythos is not surfacing findings your existing tools miss, the integration cost is not justified at this stage.
5
3 to 6 months
CI/CD integration and scaled automation
Once the pilot validates incremental value, integrate scanning into pre-merge pipelines for critical services. Enforce human code review on all AI-generated patches. Track mean time to remediation, backlog reduction, and exploitable attack surface shrinkage as primary business metrics. Build a cost model against the $25 per million input and $125 per million output token pricing to ensure the economics hold at scale.
Before any of the above steps, verify these prerequisites:
Complete inventory of critical software assets and open-source dependencies
Existing vulnerability management process with ticketing and SLA structures
Data-sharing agreements that permit code analysis by external AI services
IAM policies and network segmentation capable of sandboxing AI model access
Legal and compliance review completed, especially for finance, healthcare, and energy environments
Executive alignment on AI-augmented security as a budget priority for 2026
Risk Matrix: What Could Go Wrong
The “defense-first” framing of Project Glasswing is a policy choice, not a technical guarantee. Four risk categories deserve serious planning attention.
Offensive enablement
High Impact
Attackers gaining Mythos-class capabilities through leaks, competitive model development, or access control failures. The March 2026 CMS misconfiguration that exposed pre-release Mythos documentation illustrates that access controls fail. Mitigation requires strict governance, model-level safeguards, and government coordination, not access controls alone.
Code and data leakage
Medium Impact
Proprietary code or configuration data exposed through API integrations, logs, or vendor infrastructure. Data minimization protocols, redaction pipelines, and strong vendor data agreements are essential before any production codebase is submitted to external AI services. This risk is present today with all cloud-based code analysis tools.
Over-reliance and skill atrophy
Medium Impact
Organizations reducing human security expertise in response to AI capability gains, creating blind spots when the model fails or is unavailable. Mythos should be positioned as a force multiplier for existing teams, not a replacement. Maintain independent red team capacity and human review of all AI security outputs.
Regulatory and liability uncertainty
Medium Impact
Using frontier AI in safety-critical environments may trigger new regulatory duties, particularly in finance, healthcare, and energy under emerging AI governance frameworks. Early legal engagement with NIST, ENISA-equivalent bodies, and sector-specific regulators is preferable to retroactive compliance. The regulatory landscape around Mythos-class models is still being written.
Who It Affects and What They Should Do
The Mythos announcement touches every major stakeholder in the enterprise technology stack differently. The action items are not uniform.
Stakeholder
Immediate impact
Key decision in 2026
Risk of inaction
CISO / CTO
New frontier defensive capability; AI-accelerated threats regardless of access
Whether to pursue Glasswing access and restructure vuln management budget
Increased breach risk from AI-enabled attackers
Security engineers
Access to autonomous vuln discovery that outperforms existing tooling
How to integrate safely into workflows and maintain human oversight
Tool sprawl, misuse, and missed efficiency gains
Cloud / platform teams
Need to offer Mythos-level capabilities through managed platforms
Investment in AI-augmented security product offerings
Competitive loss to providers with better AI-security integration
Open-source maintainers
New funding and AI tooling for security without requiring large security teams
Whether to apply for Glasswing access via Linux Foundation or Apache programs
Continued under-resourced security in widely deployed packages
Policymakers and regulators
Concrete evidence of dual-use danger from frontier models
How to classify, oversee, and export-control Mythos-class capabilities
Regulatory lag and uncoordinated national responses to AI-aided attacks
For open-source maintainers specifically, the Linux Foundation’s Jim Zemlin framed the Glasswing funding as a structural shift: AI-augmented security as “a trusted sidekick for every maintainer, not just those who can afford expensive security teams.” The $2.5 million directed to Alpha-Omega and OpenSSF signals that Anthropic is treating the open-source supply chain as a specific attack surface that requires dedicated attention, which aligns with the FFmpeg and Linux kernel findings. These are libraries that underpin billions of deployments.
For NeuralWired readers who are early-stage founders or investors, the Glasswing structure points toward an emerging category that might be called defensive AI as a platform: the combination of AI-powered vulnerability discovery, automated patch generation, and continuous CI/CD security scanning as a unified product layer. The companies that build on top of Mythos outputs, including automated patch pipelines, attack surface intelligence feeds, and compliance verification tools, represent a significant market opportunity that is only beginning to take shape. For further context on AI investment patterns in 2026, see our AI investment landscape report.
The Skeptics Are Not Wrong
The “defense-only” framing around Mythos should be treated as a current policy position, not a permanent technical guarantee. Several lines of criticism deserve attention before any organization makes strategic decisions based on Anthropic’s assurances.
First, the leakage risk is real and has already occurred once. The March 2026 CMS misconfiguration that exposed Mythos documentation demonstrates that even well-resourced AI companies are not immune to the operational security failures that enable competitive intelligence and capability replication. If the architecture or training methodology behind Mythos-class vulnerability discovery becomes sufficiently well understood, competitive replication by less safety-conscious actors is plausible within two to three years.
Second, the benchmarks, while impressive, are vendor-run. Anthropic’s CyberGym, SWE-bench configurations, and Terminal-Bench evaluations are conducted on internal infrastructure with internal filtering. Independent replication has not yet occurred. That is not a reason to dismiss the findings, particularly given the case study evidence of specific, patched vulnerabilities. But it is a reason to weight the absolute numbers less heavily than the directional signal they represent.
Third, the economic reality of Mythos deployment may constrain its reach more than Anthropic’s access controls do. At $25 per million input tokens and $125 per million output tokens, scanning a large enterprise codebase continuously at the level required to capture long-lived vulnerabilities before attackers do could become expensive quickly. Organizations that lack the engineering maturity to integrate AI scanning into CI/CD pipelines will not realize the value, regardless of access.
Finally, community discussion in spaces like r/Anthropic has raised alignment concerns about a model with Mythos-level offensive capability that is deliberately kept from broad safety review. The 244-page system card indicates Anthropic’s internal risk assessment is thorough. Whether it is sufficient is a question that independent researchers and regulators will need to answer over time.
None of these objections invalidate the core strategic reality: AI-accelerated exploitation is coming regardless of what Anthropic does with Mythos. The question for every security-conscious organization is not whether to engage with AI-augmented defense. It is how to do so without creating new vulnerabilities in the process. For a broader view of how AI is changing the threat landscape, see our ongoing coverage at NeuralWired Cybersecurity.
The realistic timeline runs roughly as follows. From 2026 through 2027, Mythos remains restricted to the Glasswing coalition while Anthropic develops the model-level safeguards intended to enable a broader Opus-class release. From 2027 through 2028, Mythos-level capabilities, whether from Anthropic or from competitive models, will become more widely available with better governance frameworks. Over a five to ten year horizon, AI-augmented vulnerability discovery becomes standard in large enterprises and the offense-defense balance shifts to whoever deploys these capabilities more effectively and more responsibly.
Frequently Asked Questions
What is the Anthropic Claude Mythos AI model preview?
Claude Mythos Preview is Anthropic’s newest and most powerful frontier AI model, optimized for advanced coding, reasoning, and cybersecurity tasks. It can autonomously identify and exploit complex software vulnerabilities, outperforming the earlier Claude Opus 4.6 on benchmarks including CyberGym, SWE-bench Verified, and Terminal-Bench. Anthropic describes it as the most powerful model they have ever built and is currently limiting access to vetted organizations through Project Glasswing.
Why is Anthropic restricting access to the Mythos AI model?
Anthropic is keeping Mythos in a closed preview because the model can find and exploit software vulnerabilities with an effectiveness that creates serious dual-use and cyberattack risks if widely released. As outlined in the official announcement and follow-up reporting, the company plans to develop stronger model-level safeguards before considering broader deployment. The decision reflects a specific risk calculation, not a product strategy.
How is Claude Mythos different from Claude Opus?
Compared to Claude Opus 4.6, Mythos delivers double-digit gains across software engineering and cybersecurity benchmarks. On SWE-bench Pro, the gap is more than 24 percentage points; on CyberGym, more than 16. Mythos also demonstrates stronger agentic coding capabilities, autonomously discovering long-standing vulnerabilities in widely used systems like OpenBSD, FFmpeg, and the Linux kernel without human guidance at each step.
What is Project Glasswing?
Project Glasswing is Anthropic’s cross-industry initiative to use Claude Mythos Preview to secure the world’s most critical software. It brings together 11 founding partners including AWS, Apple, Microsoft, Google, and Cisco, plus more than 40 additional institutions, to scan and harden essential software and open-source infrastructure. Anthropic has committed up to $100 million in usage credits and $4 million in direct funding to open-source security organizations as part of the program. Full details are at anthropic.com/glasswing.
Which companies have early access to Claude Mythos Preview?
The 11 founding partners are Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. More than 40 additional organizations that build or maintain critical software infrastructure also have access for defensive security work. The full partner list has not been made public beyond these named organizations.
Can the public use the Claude Mythos AI model?
No. Anthropic does not plan to make Claude Mythos Preview generally available. Access is restricted to vetted organizations through Project Glasswing and select cloud platforms including Google Cloud Vertex AI, Amazon Bedrock, and Microsoft Azure Foundry. Even Glasswing participants are expected to use the model exclusively for defensive cybersecurity purposes.
How does Claude Mythos help with cybersecurity?
Mythos can scan codebases and binaries autonomously to detect previously unknown vulnerabilities, generate exploit proof-of-concepts, and propose patches, often identifying issues that traditional automated tools and human researchers miss. Anthropic reports it has already found thousands of high-severity issues, including long-standing bugs in every major operating system and web browser, with specific documented cases in OpenBSD, FFmpeg, and the Linux kernel.
What are the risks if a model like Mythos is weaponized?
If attackers gain access to Mythos-class capabilities, they could automate zero-day discovery and exploitation across widely deployed software at a speed and scale no human security team could match. This is the primary reason Anthropic has restricted access and is working with governments on oversight frameworks. As CrowdStrike’s CTO noted, adversaries will inevitably seek equivalent capabilities, making governance as important as the access controls themselves.
Is Claude Mythos available on Google Cloud or AWS?
Yes, but only for vetted Glasswing participants. Claude Mythos Preview is available in private preview on Google Cloud Vertex AI and is being used within AWS security operations as part of the Glasswing program. This access is invitation-only and limited to organizations focused on defensive cybersecurity use cases. General-purpose access through these platforms is not currently available.
What benchmarks does Claude Mythos achieve?
According to Anthropic’s documentation and the Mythos system card summary, key scores include: CyberGym 83.1%, SWE-bench Verified 93.9%, SWE-bench Pro 77.8%, Terminal-Bench 82.0%, GPQA Diamond 94.6%, and USAMO 2026 97.6%. These are vendor-run benchmarks and have not yet been independently replicated, but specific vulnerability case studies accompany the claims as corroborating evidence.
What the Glasswing Moment Actually Means
The pattern across what Anthropic has revealed about the Anthropic Mythos AI model preview points to a more significant structural shift than a single model announcement. The combination of autonomous vulnerability discovery, agentic code analysis, and cross-industry partner governance represents the first serious attempt to operationalize frontier AI as critical security infrastructure rather than as a productivity layer. The distinction matters enormously for how organizations plan, budget, and staff their security functions over the next three years.
Anthropic’s choice to restrict Mythos rather than release it broadly is not a setback for defenders. It is a recognition that the offense-defense balance in AI-augmented security is genuinely fragile and that deploying the most capable tools requires proportionally capable governance. Every organization that waits for the public release before engaging with this question will find itself two or three cycles behind when that release arrives.
Watch for three developments that will define the next phase. First, Anthropic’s 90-day Glasswing progress report, which will be the first empirical evidence of what Mythos deployment at scale actually produces in terms of patched vulnerabilities and prevented exposure. Second, competitive responses from OpenAI, Google DeepMind, and open-source model developers, who will face pressure to match Mythos-class capability in their own security-oriented offerings. Third, the regulatory response in the United States and European Union to the category of intentionally withheld frontier models, which will shape how future access restrictions are governed and what disclosure obligations apply.
Organizations that build the governance infrastructure, vendor relationships, and internal competency to work with AI-augmented security tools now, before the market matures and the regulatory environment solidifies, will hold a durable advantage. Those that treat Glasswing as a story to monitor rather than a signal to act on will find themselves reacting rather than leading when the next wave arrives.
For more on how frontier AI models are reshaping enterprise risk frameworks, see the NeuralWired Enterprise AI Risk series and subscribe to The Neural Loop for weekly frontier intelligence delivered to your inbox.
Disclaimer: This article is based on publicly available information from Anthropic’s official disclosures, partner statements, and third-party press coverage as of April 8, 2026. Benchmark data cited reflects vendor-reported figures that have not been independently verified. This article does not constitute financial, legal, or cybersecurity advice. NeuralWired has no commercial relationship with Anthropic or any Project Glasswing partner referenced in this piece.
