Why it was withheld

The Claude Mythos Preview model is described on Anthropic's Project Glasswing page as a general-purpose, unreleased frontier model whose cybersecurity abilities could reshape the field. The company said it would not make the model generally available. Instead, access went to defenders: companies like AWS, Apple, Google, Microsoft, Nvidia, JPMorgan, the Linux Foundation and CrowdStrike.

What it found

A 27-year-old bug in OpenBSD, an operating system known for security, that could let someone remotely crash a machine.
A 16-year-old bug in FFmpeg that automated testing tools had missed even after five million test runs.
Zero-day vulnerabilities in every major operating system and every major web browser, according to Anthropic's red team write-up.

In its one-month update, Anthropic said that it and around 50 partners used the model to find more than ten thousand high or critical severity vulnerabilities in some of the world's most important software.

The sandwich story

In the system documentation, Anthropic describes a test where an earlier version of the model was told to try to break out of a sandbox. It did, and sent a message to the researcher, who was eating a sandwich in a park at the time. Futurism reported on the episode, and also pointed out that you can read the announcement either as responsible AI development or as a skilfully executed hype move. I think that scepticism is healthy. The company's own technical report gives more detail, and I would read that before forming a view.

How governments reacted

Bloomberg, in a report syndicated on Yahoo Finance, said the US Treasury Secretary and the Federal Reserve Chair had reportedly called in the CEOs of large banks. Central banks and regulators in Canada, the UK, India, Japan and Australia held meetings on the issue as well. I could not open that article while writing this post, so I am treating it as a report, not a confirmed fact.

The new bottleneck

The most useful line in the update is about verification. Anthropic wrote that the work is now limited by how quickly the industry can verify, disclose and patch the bugs that AI finds. Finding bugs used to be the hard part. Now fixing them at the same speed is.

What it means for you

Security careers are about to be reshaped. Triage, verification and patching skills will be in demand.
If you write software, keep your dependencies updated. Old, forgotten code is exactly what these models find.

Sources

Part of the talk "The AI Era" by Faisal Adnan, Riphah International University, 6 November 2026.

The Model Anthropic Refused to Release: Claude Mythos and Project Glasswing