A Model Too Capable for Public Release

When Anthropic unveiled Claude Mythos Preview in early April 2026, the company made an unusual decision: it declined to release the model publicly at all. That restraint was deliberate, and the reasoning was frank. Claude Mythos Preview is a general purpose, unreleased frontier model that reveals a stark fact: AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.

The model's capabilities had crossed a threshold that Anthropic believed warranted a different approach entirely. Rather than a standard commercial release, the company launched Project Glasswing: a controlled, vetted access program built around Mythos and aimed squarely at the defense side of cybersecurity.

Project Glasswing is an urgent attempt to put these capabilities to work for defensive purposes. The launch partners included Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Anthropic committed up to $100 million in usage credits for Mythos Preview across these efforts, as well as $4 million in direct donations to open source security organizations.

The scale of what followed was striking. Within weeks of launch, Anthropic and its approximately 50 partners had used Claude Mythos Preview to find more than ten thousand high or critical severity vulnerabilities across the most systemically important software in the world. Companies including Cloudflare and Mozilla each discovered hundreds of vulnerabilities in their own codebases.

What Mythos Actually Found

The vulnerability counts alone do not capture what made Mythos technically significant. The model was not simply running known exploit signatures against codebases. It was finding genuinely new flaws, autonomously, without human direction at each step.

Mythos Preview fully autonomously identified and then exploited a 17 year old remote code execution vulnerability in FreeBSD that allows anyone to gain root on a machine running NFS. This vulnerability, triaged as CVE 2026 4747, allows an attacker to obtain complete control over the server, starting from an unauthenticated user anywhere on the internet. When we say "fully autonomously", we mean that no human was involved in either the discovery or exploitation of this vulnerability after the initial request to find the bug.

A separate example involved wolfSSL, a cryptography library embedded in billions of devices worldwide. Mythos Preview constructed an exploit that would let an attacker forge certificates that would allow them to host a fake website for a bank or email provider, one that would look perfectly legitimate to an end user, despite being controlled by the attacker.

Mythos Preview has improved to the extent that it mostly saturates existing benchmarks. Anthropic therefore turned its focus to novel real world security tasks, because metrics that measure replications of previously known vulnerabilities can make it difficult to distinguish novel capabilities from cases where the model simply remembered the solution. Zero day vulnerabilities, by definition, address that limitation.

The UK AI Security Institute confirmed what the benchmark data implied: Mythos was able to complete a 32 step simulated corporate cyberattack in 3 out of 10 runs, a task no AI model had ever successfully completed before Mythos.

Project Glasswing Expands Then Gets Complicated

By June 2, 2026, Anthropic had significantly broadened Project Glasswing's reach. The company extended access to approximately 150 new organizations in more than fifteen countries, covering power, water, healthcare, and communications, sectors not well represented in the initial cohort. New members included Okta, Samsung, SK Hynix, SK Telecom, NATO, and ENISA, the EU's cybersecurity agency.

For most Project Glasswing partners, Anthropic estimates that a successful cyberattack on their codebase could affect more than 100 million people, with important ramifications for both global and national security.

Partners were by this stage using Mythos for more than vulnerability discovery alone. Members now deploy the model for automated patch writing, pre release security checks, penetration testing simulations, threat detection, and rebuilding legacy codebases in memory safe languages. Anthropic also released a suite of supporting tools: a codebase mapping harness, a threat model builder, and custom scanning skills developed during the program's first weeks.

Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI. The bottleneck had shifted from discovery to remediation, a problem Anthropic acknowledged would require industry wide coordination to solve.

Mythos Preview is priced for Glasswing participants at $25 per million input tokens and $125 per million output tokens, accessible via the Claude API, Amazon Bedrock, Google Cloud's Vertex AI, and Microsoft Foundry.

The Government Intervenes: Both Models Go Offline

The most consequential development arrived in late June 2026 and was absent from the original version of this article entirely. In June 2026, the Trump administration directed Anthropic to restrict access to its Fable 5 and Mythos models for foreign nationals, citing national security concerns. Claude Fable 5 is a Mythos class model that Anthropic had released to enterprise customers and paid subscribers on June 9, 2026, after developing new safeguards to make broad deployment viable.

The restriction created an immediate operational problem. Because Anthropic had no reliable way to verify the nationality of its users at scale, the company disabled both models worldwide for everyone. As of June 23, Fable 5 and Mythos 5 remained offline, with no official restoration date from Anthropic or the US Department of Commerce.

The directive arrived weeks after Anthropic CEO Dario Amodei had met with senior members of the Trump administration to discuss Mythos and after Federal Reserve Chairman Jerome Powell and Treasury Secretary Scott Bessent had separately convened meetings with major bank CEOs to discuss the model's implications. The administration was clearly paying attention to Mythos. Its intervention ultimately grounded it.

OpenAI's Competitive Response

OpenAI moved within days of Mythos's April launch. CEO Sam Altman announced GPT 5.5 Cyber, a frontier AI model built specifically for cybersecurity, describing a rollout beginning immediately to "critical cyber defenders." The approach differed deliberately from Anthropic's consortium model: OpenAI coordinated access with government agencies in advance and pursued a broader international rollout from the start.

OpenAI signed Trusted Access for Cyber partnerships with Australia, Canada, France, Germany, Japan, South Korea, and EU institutions including ENISA. Its Codex Security tool scanned more than 30 million commits across over 30,000 codebases since launching in March, logging more than 500,000 fixed vulnerabilities.

On raw benchmark performance, the gap between the two systems is now narrow. On the CyberGym leaderboard, OpenAI's GPT 5.5 Cyber leads with 85.6 percent against Mythos 5's 83.8 percent. OpenAI followed with GPT 5.6 Sol, which claims a lead over Anthropic's Claude Mythos in agentic coding and matches it in cybersecurity, while burning roughly a third of the output tokens on ExploitBench.

The competitive gap is easier to see in the benchmark data itself:

Figure: Selected benchmark comparison between Anthropic's Mythos/Fable 5 models and OpenAI's GPT-5.6 Sol. ExploitBench reflects OpenAI's direct published comparison against Mythos Preview, while other rows use publicly available benchmark values.

While Anthropic's Fable 5 and Mythos 5 remain offline under government order, OpenAI's models continue operating without comparable restrictions, and in June 2026, OpenAI offered GPT 5.5 Cyber to nine major UK banks, institutions that were effectively barred from accessing Mythos under the new restrictions. The competitive asymmetry is now as much a function of regulatory status as technical capability.

The Structural Tension: Defense First, But Who Controls the Keys

The government's intervention in Mythos access crystallizes the central tension in deploying frontier AI cybersecurity models. Anthropic built Mythos specifically to give defenders an early advantage, predicated on controlled, vetted distribution before equivalent capabilities proliferate. Anthropic estimates that within six to twelve months, competing AI companies will develop Mythos class models, potentially releasing them without sufficient safeguards to prevent offensive misuse.

That assessment appears to be proving accurate already. OpenAI's GPT 5.5 Cyber and GPT 5.6 Sol are functionally competitive with Mythos across most measured dimensions. The safeguard question, how to make these capabilities broadly available for defense without making them accessible for offense, has not been resolved by either company, or by the government that intervened in Anthropic's rollout.

The bottleneck in cybersecurity is now verifying, disclosing, and patching the large numbers of vulnerabilities that Mythos class models can surface. Hundreds of thousands of organizations, researchers, and maintainers will likely need access to the most advanced cyber capabilities to address the full scope of the coming threat environment. Neither a closed consortium nor a government restricted deployment gets there at that scale.

The window between a vulnerability being discovered and being exploited by an adversary has collapsed, what once took months now happens in minutes with AI. The critical infrastructure sectors now enrolled in Project Glasswing understand this. The question of who controls access to the tools that can close that window is no longer a purely technical matter. It is a policy question, and Washington has now made clear it intends to answer it.

Conclusion

Project Glasswing demonstrated that AI assisted vulnerability discovery at scale is not a theoretical capability, it is operational. More than 10,000 critical flaws found, across infrastructure that billions of people depend on, in a matter of weeks. The model that did it has since been taken offline by government order, its Mythos class successor launched and then grounded as well, and a direct competitor has filled the access gap internationally.

The race to make frontier cybersecurity AI work for defenders rather than adversaries is real. What Glasswing revealed is that the hardest problems are not technical. They are the questions of governance, access, and enforcement that now sit at the intersection of national security and commercial AI development.

Verified against Anthropic's official Project Glasswing announcements and cybersecurity assessment, along with reporting from CNBC, TechCrunch, Axios, Cybersecurity Dive, The Decoder, and other major technology and security publications. Benchmark data reflects published results from Anthropic, OpenAI, and the UK AI Security Institute.

Loading Article...

Loading Article...