Anthropic’s Mythos Preview AI Finds Thousands of Hidden Flaws — Company Locks It Behind Project Glasswing as Experts Warn of a New Cyber Threat
Anthropic’s unreleased Claude Mythos Preview is a powerful frontier AI that finds and chains software vulnerabilities at scale. Access is limited to vetted partners through Project Glasswing, amid warnings it could accelerate both defense and offense.
- Large-scale discovery: Mythos reportedly flagged “tens of thousands” of zero-days and can build exploit chains, dramatically expanding bug discovery speed and scale.
- Restricted access: Anthropic made Mythos available only to vetted partners via Project Glasswing rather than a public release.
- Dual-use risk: Defenders gain powerful scanning capabilities, but the same techniques could be weaponized if misused or leaked.
- Local impact: Cities and small businesses — including Huntington Beach — face increased urgency to adopt data-centered defenses and rapid patching.
What Mythos is and why Anthropic restricted access
Anthropic describes Claude Mythos Preview as a frontier model that, in tests, behaved like top human security researchers: digging into decades-old code and surfacing vulnerabilities human teams missed. Because Mythos can both locate and chain flaws into working exploits, Anthropic chose a controlled rollout via Project Glasswing to vet safety measures and guardrails.
“Tens of thousands” of zero-days is the scale Anthropic and reporting have described in internal testing; the company emphasizes defensive use with strict partner controls.
What testing showed — and what remains unverified
Public reporting and Anthropic’s technical posts highlight speed and scale. Axios reporting noted Mythos outpaced prior models and cited an 83.1% first-attempt exploit success rate in some tests. Anthropic’s own write-up on Mythos Preview details “tens of thousands” of zero-days found internally and the model’s ability to link them into exploit chains.
Verification note: Specific circulating figures (for example, one team finding “more than 2,000 previously unknown vulnerabilities in seven weeks”) exceed corroborated public documentation. Journalists and readers should treat such precise claims as unverified until further documentation is published.
Platforms and notable findings
Reporting says Mythos uncovered issues across major platforms, including the Linux kernel and legacy bugs in OpenBSD. Some findings could enable full system takeovers or remote crashes in high-security networking devices. The model’s exploit-chaining ability raises the stakes by assembling multi-step attacks from separate flaws.
Who has access under Project Glasswing
Anthropic invited more than 40 organizations to test Mythos under Project Glasswing. Participants include major cloud, security and open-source organizations such as:
- Microsoft, Google, AWS, Apple, Cisco
- CrowdStrike, Palo Alto Networks, NVIDIA, JPMorgan Chase
- Open-source groups: the Linux Foundation and the Apache Software Foundation
Anthropic has offered usage credits (reportedly up to $100 million) to help partners scan and harden code at scale. CrowdStrike, a founding member, has argued for governance, threat-sharing and integrating AI findings into defensive tooling; see the CrowdStrike blog.
Why this matters: AI changes the cyber risk calculus
Security vendors and researchers say models like Mythos shift the balance by speeding discovery and exploit creation. The routine of “find a bug, patch a bug” may not keep pace with AI-accelerated discovery. That creates a dual reality: defenders can harden systems faster, but attackers with access to similar capabilities could weaponize them.
Recommended defensive posture: move toward data-centered protections — encryption by default, fine-grained access controls, strong authentication, and assuming breach scenarios so that data remains protected even if systems are penetrated.
Implications for Huntington Beach, California
Huntington Beach hosts many small and medium businesses, tourist-facing operations and local energy infrastructure that rely on third-party software and cloud services. If attackers use AI to discover zero-days faster, local firms could face outages, data theft or supply-chain impacts.
Practical steps for local leaders and businesses:
- Enforce multi-factor authentication and rapid patching.
- Encrypt sensitive data at rest and in transit; adopt key-management best practices.
- Invest in endpoint visibility and threat-hunting partnerships with vetted firms.
- Run red-team exercises, threat assessments, and coordinate with federal resources.
Local IT and managed-service providers can view this as a market opportunity to offer data-first security services: encryption, secure backups, incident response and AI-aware threat management.
Missing or unconfirmed pieces
Some widely circulated details lack corroboration in public reporting. For example, a quoted figure attributed to a specific individual (John Ackerly of Virtru) does not appear in Anthropic or Axios posts. A YouTube video claims unauthorized access to Anthropic systems on announcement day, but that claim has not been independently verified. Distinguish confirmed company posts and reporting from unverified anecdotes.
Policy, defense and coordination implications
Because Mythos-level capabilities affect national infrastructure and financial systems, policymakers and private-sector leaders should push for clearer guidance, funding incentives for hardening critical systems, and public-private information-sharing frameworks. Anthropic’s controlled rollout demonstrates one model for responsible testing, but broader policy work is needed to scale protections beyond large tech firms.
Sources and further reading
- Anthropic Project Glasswing
- Anthropic technical post on Mythos Preview
- Axios reporting on Anthropic and Mythos
- CrowdStrike on joining Anthropic’s initiative
- Unverified video claiming system access
Reporting compiled from company posts and public coverage; readers should treat highly specific circulation claims as unverified until documentation is released.
