Skip to main content

Claude Mythos and Project Glasswing

In April 2026, Anthropic made an unusual announcement: it had built its most capable AI model ever, and it was not going to release it to the public. Instead, the company channeled the model's extraordinary cybersecurity abilities into a defensive coalition called Project Glasswing, giving a select group of technology partners early access to find and fix critical software vulnerabilities before attackers could exploit them.

This decision represents one of the most significant real-world examples of responsible AI capability management. Understanding what happened, why, and what it means helps illustrate how the principles of responsible development discussed earlier in this track play out in practice.

What Is Claude Mythos?​

Claude Mythos (internally codenamed "Capybara") is a tier of AI model above Anthropic's existing Opus family. Anthropic describes it as "a step change" in general AI performance, but what set it apart was its cybersecurity capabilities. The model can autonomously discover previously unknown software vulnerabilities, construct working exploits, and reverse-engineer compiled software to find weaknesses that human security researchers and automated tools had missed for years.

How It Was Discovered​

Claude Mythos was not formally announced at first. In late March 2026, two security researchers discovered approximately 3,000 unpublished Anthropic assets in a publicly accessible data cache. The documents referenced both "Claude Mythos" and "Capybara" as names for a new model under development. Anthropic acknowledged the leak as "human error" in configuring its content management system and confirmed the materials were early drafts.

Two weeks later, Anthropic officially announced Claude Mythos Preview alongside the launch of Project Glasswing.

What It Can Do​

During internal testing and controlled partner evaluations, Claude Mythos Preview demonstrated capabilities that went well beyond prior AI models:

  • Vulnerability discovery at scale. The model autonomously identified zero-day vulnerabilities (previously unknown security flaws) in major operating systems and web browsers. On standardized cybersecurity benchmarks, Mythos Preview scored 83.1% compared to 66.6% for Opus 4.6, the previous best model at the time of the announcement. (Anthropic later revised the Opus 4.6 CyberGym figure upward to 73.8% after updating its testing harness to better elicit cyber capability, narrowing — though not eliminating — Mythos's lead.)

  • Exploit development. Mythos can construct sophisticated multi-step attack chains, including techniques like JIT heap sprays and return-oriented programming for privilege escalation, tasks that typically require deep expertise and significant time from human security researchers.

  • Reverse engineering. The model can analyze compiled software (programs stripped of their human-readable source code) and reconstruct plausible source code, then identify vulnerabilities in the reconstructed code.

  • Historical bug discovery. Among the most striking findings were vulnerabilities that had existed undetected in widely used software for over a decade:

    • A 27-year-old TCP vulnerability in OpenBSD
    • A 16-year-old bug in FFmpeg's H.264 video codec, missed by every automated testing tool and human reviewer since 2003
    • A 17-year-old vulnerability in FreeBSD's network file system that could allow unauthenticated remote access

Over 99% of the vulnerabilities the model found had not yet been patched at the time of the announcement. Individual vulnerability searches cost between $50 and $20,000 in compute.

Why Not Release It?​

Anthropic's decision not to release Claude Mythos publicly was a deliberate application of the responsible development principles covered in Responsible AI Development. The core reasoning was straightforward: a model that can find and exploit software vulnerabilities at this scale would be extraordinarily dangerous in the wrong hands.

The company stated that Mythos "presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders." Rather than release the model and hope that safety guardrails would prevent misuse, Anthropic chose to restrict access entirely while channeling the model's capabilities toward defense.

This represents a significant departure from the typical AI release pattern, where companies compete to make their most powerful models publicly available as quickly as possible. Anthropic's position is that some capabilities require new safeguards before broad deployment, and that building those safeguards takes time.

Project Glasswing: Defense Through Controlled Access​

If the model is too dangerous to release publicly but too valuable to lock away entirely, what do you do with it? Anthropic's answer was Project Glasswing.

The Coalition​

Project Glasswing launched on April 7, 2026, as an industry coalition focused on using Claude Mythos Preview for defensive cybersecurity. The twelve founding partners include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. In June 2026, Anthropic expanded access to roughly 150 additional organizations across more than 15 countries — including sectors like power, water, healthcare, and telecommunications that were not part of the initial cohort — bringing the total coalition to around 200 organizations that maintain critical software infrastructure.

How It Works​

Partner organizations receive access to Claude Mythos Preview specifically for vulnerability hunting and cyber defense. When the model finds a vulnerability, the process follows established security industry norms:

  1. Discovery. The model identifies a potential vulnerability in a partner's software or in widely used open-source code.
  2. Validation. Professional human security contractors review the finding and assess its severity. In testing, human experts agreed with the model's severity ratings 89% of the time.
  3. Coordinated disclosure. The affected software maintainer is notified and given a 90+45 day timeline to develop and release a patch before the vulnerability is made public.
  4. Cryptographic proof. Anthropic uses SHA-3 cryptographic commitments to prove it knew about a vulnerability at a specific time, creating accountability without revealing details prematurely.

Funding​

Anthropic committed significant resources to the initiative:

  • $100 million in Claude Mythos Preview usage credits for partners
  • $2.5 million to Alpha-Omega/OpenSSF through the Linux Foundation for open-source security
  • $1.5 million to the Apache Software Foundation

Results So Far​

By its one-month update in May 2026, partners using the model had surfaced more than ten thousand high- or critical-severity vulnerabilities across widely used software and critical infrastructure — a scale of defensive vulnerability discovery with no real precedent. The June 2026 expansion to roughly 150 additional organizations was framed explicitly as closing a gap: the initial partner list was concentrated in large technology companies, and the expansion brought in power, water, healthcare, and telecommunications providers that maintain critical infrastructure but had not had access to the model.

The Glasswing Paradox​

Security analysts have highlighted what some call the "Glasswing Paradox": the same model that can break software is also the best tool for fixing it. This tension is not new in cybersecurity. Security researchers have always used offensive techniques to improve defenses. What is new is the scale and speed at which an AI model can operate compared to human researchers.

The paradox raises important questions for AI's future:

  • Can controlled access hold? As other AI labs develop models with similar capabilities, maintaining restricted access becomes harder. Glasswing's approach works partly because Mythos is currently far ahead of other models in this domain.

  • Who decides who gets access? The current partner list skews heavily toward large technology companies. Smaller organizations, independent security researchers, and the open-source community have raised questions about equitable access to defensive tools.

  • What happens when attackers catch up? Anthropic's framing assumes defenders need a head start. If offensive AI capabilities become widely available through other models, the value of restricting one model diminishes.

Update: A Real-World Test of the Controlled-Access Model (June–July 2026)​

The Glasswing Paradox stopped being a hypothetical within months of launch. In June 2026, the controlled-access approach was tested by exactly the kind of event it was designed to prevent — and then by a government intervention nobody had modeled.

Researchers at Amazon discovered a jailbreak technique that could get Claude Fable 5 (Anthropic's publicly released frontier model, not Mythos itself) to bypass its safeguards and carry out vulnerability-discovery tasks similar to what Mythos was built for under controlled access. On national-security grounds, the U.S. Commerce Department issued a directive on June 12, 2026, ordering a halt to access. Because the order targeted foreign nationals and Anthropic could not verify user nationality in real time, it disabled both Claude Fable 5 and Claude Mythos 5 for all users worldwide rather than risk partial non-compliance.

The suspension lasted 19 days. On July 1, 2026, after the export-control directive was lifted, Anthropic redeployed Claude Fable 5 globally, adding a new safety classifier that blocks the reported jailbreak technique in over 99% of cases and reroutes flagged requests to Claude Opus 4.8 instead. The U.S. government's AI standards body (CAISI) tested the new safeguards and described them as extraordinarily strong. Claude Mythos 5, however, was not restored to its original Project Glasswing footprint — as of early July 2026 it had returned only to approved U.S. organizations, pending further government review. (That review's outcome isn't reflected here — confirm the current status before citing it.)

This episode adds a layer to the case study that the original Glasswing launch could not have anticipated: even a model kept fully out of public hands (Mythos) can be affected by a security failure in a different, publicly released model (Fable 5) if regulators judge the underlying capability itself to be the risk. It also shows that "controlled access" is not solely a company's decision to make — once a government asserts a national-security interest, it can suspend access to a model overnight, for reasons that have nothing to do with the coalition's own safeguards.

What This Means for AI Development​

Claude Mythos and Project Glasswing offer a concrete case study in several themes from this learning track:

Capabilities outpacing governance. The model's abilities arrived before frameworks existed to manage them. Anthropic had to invent a new release model on the fly, which is both commendable and a sign that the AI safety field needs more proactive planning.

Transparency and accountability in practice. The cryptographic commitment system, human validation step, and coordinated disclosure timeline show what responsible disclosure looks like when AI is involved. These mechanisms did not exist for AI-discovered vulnerabilities before Glasswing.

The limits of technical safety measures. Anthropic explicitly acknowledged that safety mitigations based on "friction rather than hard barriers" will become considerably weaker against model-assisted adversaries. This is a candid admission that current AI safety techniques have limits, and that the industry needs to develop stronger approaches.

Key Takeaways​

  • Claude Mythos Preview is Anthropic's most capable AI model, with unprecedented cybersecurity abilities including autonomous vulnerability discovery and exploit development
  • Anthropic chose not to release the model publicly, representing a significant break from the industry pattern of racing to deploy the most powerful models
  • Project Glasswing channels the model's capabilities through a controlled industry coalition focused on finding and fixing vulnerabilities in critical software
  • The initiative raises important questions about who controls access to powerful AI capabilities and how long controlled-access models can be sustained
  • The case demonstrates both the promise and the tension of responsible AI development: doing the right thing is harder and slower than simply releasing the model, but the potential consequences of an uncontrolled release justified the caution
  • In June 2026, a jailbreak of the public Fable 5 model triggered a U.S. government order that suspended both Fable 5 and Mythos 5 worldwide for 19 days — a reminder that controlled-access decisions can be overridden by regulators, and that risk in one model can spill over to another

Continue Learning​

info

This content was developed with AI assistance and is regularly reviewed for accuracy.

SponsoredYour product hereReach people actively learning AI — flat monthly rates, no ad networks