Anthropic’s Mythos AI Model: Leak, Unauthorized Access, and the Cybersecurity Debate

Anthropic’s Claude Mythos, a large-language model trained to locate software vulnerabilities, was unintentionally exposed when an unsecured data trove on Anthropic’s internal site was discovered. Within days a small, unauthorized group accessed the model, even as Anthropic began a limited rollout to select partners under Project Glasswing.

The Verge

Anthropic built Mythos to accelerate vulnerability discovery, calling it a “watershed moment for security.” The model was slated to stay under wraps, with Anthropic warning of economic, public-safety, and national-security fallout. Project Glasswing later offered it to over 40 firms—including Amazon Web Services, Apple, Google, Microsoft, NVIDIA, and JPMorgan Chase—for defensive testing.

New Scientist

Mozilla’s security team reported that Mythos uncovered 271 bugs in Firefox 150, while Anthropic claimed the model identified thousands of high- and critical-severity flaws across major operating systems. Project Glasswing currently involves 11 firms in a coordinated effort to secure critical software.

The Dispatch

The model’s speed—identifying vulnerabilities in seconds that human experts may need months to find—could compress the window for patching, reshaping defensive strategies for governments, banks, hospitals, and other critical infrastructure while also lowering the barrier for attackers.

The Dispatch

Anthropic’s website warned that uncontrolled release could cause severe economic, public-safety, and national-security fallout and announced an internal investigation of the breach. Mozilla’s CTO Bobby Holley said Mythos helped locate hundreds of bugs but none beyond elite human capability. The AI Security Institute (AISI) reported the model succeeded only against “small, weakly defended” enterprise systems.

New Scientist

Security analysts criticized Anthropic for failing to anticipate a basic, predictable breach, labeling the incident a “humiliation.” RUSI fellow Pia Hüsch highlighted that human error remains the weakest link and warned that the model’s public hype makes it an attractive target for malicious actors.

The Verge

AISI’s test said Mythos only compromised small, weakly defended systems, while Anthropic claimed thousands of high-severity flaws across major OSes. Neither Anthropic nor AISI commented on the unauthorized group’s activities.

The Verge

• “When security researchers at Mozilla, the maker of the popular web browser Firefox, pointed a powerful new artificial intelligence model at their code, they had a feeling of “vertigo.” Bobby Holley, the chief technology officer for the browser, said Anthropic’s Mythos system elevated AI from being merely a competent software engineer to “a world-class, elite security engineer.” — Bobby Holley, CTO, Mozilla

Washington Post

• “a legitimate technological capability, reframed as civilisational threat, by a party that benefits from the reframing” — Davi Ottenheimer, security expert

New Scientist

• “What happens when a machine can do in seconds what a skilled human hacker takes months to accomplish?” — Kevin Curran, Ulster University

New Scientist

• “Pia Hüsch, a research fellow at the British think tank Royal United Services Institute (RUSI), told me that no company is ever completely secure and humans are often the weakest link, though it “does initially seem a bit lucky” that there were no serious consequences.” — Pia Hüsch, research fellow, Royal United Services Institute (RUSI)

The Verge

• “Mythos the model is like this amazing engine, right? But an engine by itself sitting on a stand inside of a lab like that doesn’t win a race,” — Jamieson O’Reilly, co-founder, Aether AI

The Dispatch

Anthropic’s CEO Dario Amodei predicts Chinese open-source models could match Mythos within six to twelve months, and industry leaders warn the window to secure software before adversaries acquire similar tools is rapidly closing.

The Dispatch