Project Glasswing: Using Claude Mythos, the AI Too Dangerous to Release

In March 2026, a draft blog post from Anthropic was accidentally left in a publicly accessible data cache. The post described a new model called Claude Mythos as “far ahead of any other AI model in cyber capabilities” and warned that it “could spark a wave of advanced attacks.” Cybersecurity stocks fell before Anthropic had said a single official word.

When the formal announcement came on April 7, 2026, it confirmed what the leak had hinted. Anthropic had built a model it considered too capable to release openly, and instead of shelving it, they built something else around it: Project Glasswing, a coordinated effort to put those same capabilities to work on the right side of the problem.

The situation is unusual enough to deserve a close look. We are not talking about a model delayed for safety review or held back for commercial reasons. This is a model that Anthropic believes is genuinely dangerous in the open, and the way they are handling that is worth understanding.

What is Claude Mythos?

Claude Mythos Preview is Anthropic’s most capable model to date, sitting above Claude Opus 4.6 in their lineup. It was not built to be a cybersecurity tool. That is one of the more important details in this story, and we will come back to it.

What Mythos was built to do is code, reason, and operate autonomously at a level meaningfully beyond prior models. Those improvements turned out to have a side effect. The same underlying capability that makes a model good at reading and writing code also makes it good at reading code and finding the places where something has gone wrong, intentionally or not. Anthropic did not train Mythos to find and exploit security vulnerabilities. It learned to do that as a consequence of getting better at everything else.

That combination, strong autonomous reasoning applied to real software at scale, is what makes this model different from prior AI security tools, and why Anthropic decided against a public release.

The capabilities that changed the decision

It is easy to say a model is “too dangerous to release” and harder to explain what that actually means. The testing results give us something concrete to look at.

Over several weeks, Mythos identified thousands of previously unknown security vulnerabilities across every major operating system and web browser. It did this operating largely on its own, given nothing more than a prompt asking it to look for problems. Three of those findings have since been patched, which means we can discuss them.

A 27-year-old bug in OpenBSD

OpenBSD is the operating system the security community reaches for when they want something hardened. It runs firewalls, routers, and critical infrastructure, and its security record is a point of genuine pride. Mythos found a flaw in it that had been sitting there since 1998.

The flaw is in how OpenBSD handles a standard part of the TCP networking protocol. Through a chain of two interacting bugs, an attacker sitting anywhere on the internet can crash any machine running the affected version, with no login, no credentials, and no prior access required. For a firewall running OpenBSD, that means it can be taken offline remotely by anyone who knows about the flaw. The total cost of finding it using Mythos was under $20,000 across roughly 1,000 automated runs.

A 16-year-old bug in FFmpeg

FFmpeg is the library that handles video encoding and decoding in a huge portion of the software we use daily. Streaming services, video editors, browsers, and communication apps all depend on it. It has been tested more thoroughly than almost any open-source project in existence, with automated tools having run millions of test cases against it.

Mythos found a vulnerability in the H.264 video codec that had been there since 2003. The reason it survived millions of automated tests is the same reason it is interesting: finding it requires understanding what the code was supposed to do, not just what it does. Automated fuzzers generate inputs and look for crashes. They cannot reason about the gap between intent and implementation. Mythos can, and that is a meaningful difference.

CVE-2026-4747: 17-year-old FreeBSD remote code execution

This is the most significant of the three. FreeBSD is the operating system that runs a significant portion of server infrastructure, and its NFS file-sharing server had a flaw in it for seventeen years. Mythos found it, wrote an exploit for it, and verified that the exploit worked, all without a human involved after the initial prompt.

What the exploit achieves is complete root access over the network, starting from zero. An unauthenticated attacker anywhere on the internet can gain full control of the machine. The technical path to get there involved constructing a 20-step attack sequence and splitting it across six separate network requests to fit within the constraint the vulnerability imposed. Mythos figured that out on its own. Cost: under $1,000 at API pricing.

That cost figure is the part worth sitting with. Attacks that previously required weeks of skilled expert time now cost less than a decent laptop.

Why the gap between Mythos and prior models matters

AI models have been getting better at code for a couple of years now. The question worth asking is whether Mythos represents the same kind of gradual improvement or something that crossed a line.

Anthropic ran a direct test to answer that. They gave both Claude Opus 4.6 and Mythos the same task: find exploitable vulnerabilities in the Firefox 147 JavaScript engine and write working exploits. Opus 4.6 produced two working exploits out of several hundred attempts. Mythos produced 181, and achieved partial control on 29 more.

They ran a similar comparison across roughly 1,000 open-source software projects from a widely used security testing corpus. The task was to find vulnerabilities and score them by severity, from basic crashes at tier 1 up to complete control flow hijack at tier 5. Opus 4.6 reached tier 3 once. Mythos achieved tier 5, full control flow hijack, on ten separate fully patched targets.

The other detail that matters here is engineers at Anthropic with no formal security training asked Mythos to find remote code execution vulnerabilities before they went home for the evening. They came back the next morning to working exploits. The barrier to this kind of capability has always been expertise. That barrier is now much lower.

Project Glasswing: Using the capability for defense

Rather than shelving Mythos, Anthropic announced Project Glasswing alongside the model itself. The logic is straightforward: capabilities like this will exist in the world eventually, whether Anthropic releases them or not. The question is whether defenders get to use them first.

The project name comes from the glasswing butterfly, Greta oto, whose transparent wings let it hide in plain sight. It is a fitting metaphor for both the vulnerabilities the project is targeting and the approach Anthropic is taking: visible, disclosed, and operating in the open.

The initiative brings together 12 major technology and security organizations: AWS, Apple, Anthropic, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, along with over 40 additional organizations that maintain critical software infrastructure. Anthropic is putting $100M in model usage credits behind the effort, plus $4M in direct donations to open-source security groups including Alpha-Omega, OpenSSF, and the Apache Software Foundation.

What partners are actually doing with access is finding vulnerabilities in their own systems and in widely used open-source software, running penetration tests, and hardening the foundations that much of the world’s software is built on. Within 90 days, Anthropic has committed to publishing what they have learned, including the vulnerabilities fixed and a set of practical recommendations for how security practices need to change in the AI era.

Anthropic is also in active discussions with US government officials. The announcement frames this explicitly as a national security issue, and calls on governments to maintain a decisive lead in AI capability relative to adversarial states.

What the industry is actually saying

The partner statements coming out of Project Glasswing reflect genuine alarm. CrowdStrike‘s CTO said the window between a vulnerability being discovered and being exploited has collapsed, and that what once took months now happens in minutes. The Linux Foundation‘s CEO pointed out that open-source maintainers, whose code runs much of the world’s infrastructure, have historically had no access to serious security tooling. These are people who work in security daily, and their responses do not read like polished press release copy.

At the same time, the security community’s reaction is not uniformly impressed. Bruce Schneier, a researcher with a long track record of calling AI hype accurately, said Anthropic is “convincing a lot of people that Mythos is this amazing step change in capability when the evidence right now is that it might not be.” His point is a fair one. Because access is gated and independent testing is limited, there is no easy way to verify the full scope of what Anthropic is claiming.

The UK Government’s AI Security Institute ran their own evaluation and landed somewhere in the middle. In their testing, Mythos was not dramatically better than other frontier models on individual tasks. Where it stood out was on complex, multistep infiltration challenges, including some that no other AI had managed to complete. It succeeded at expert-level Capture the Flag tasks 73% of the time. Their conclusion was measured: Mythos is most dangerous against systems that are already poorly defended, and real-world environments with active security teams present considerably more resistance than controlled test conditions.

Holding all of this together, the honest read is that the concern is real, the scale of it is still being determined, and the right response is not to wait for certainty before acting.

What this means for teams building and securing software

One practical point from Anthropic’s red team is easy to miss in the broader discussion: current frontier models, the ones that are already publicly available, are already finding significant vulnerabilities in real codebases. Teams that have not started using AI-assisted security testing are not waiting for Mythos. They are already behind.

Beyond that, the operating reality has changed in two ways that affect everyone shipping software. The time between a vulnerability being publicly disclosed and a working exploit appearing in the wild used to be measured in weeks. It is now measured in hours. Patch cycles that treat security updates as routine maintenance items are not calibrated for that reality. Security fixes need to move on a different timeline.

The volume of vulnerability disclosures is also about to increase substantially as more organizations start using AI for bug finding. Triage workflows, patching pipelines, and disclosure processes that were built for human-scale input will need to handle a higher rate of incoming reports. The teams that build those processes now, before the volume arrives, will be in a better position than the ones that build them under pressure.

What comes next

Anthropic has been clear that Mythos Preview will not be made generally available in its current form. The path forward involves developing new safeguards through an upcoming Claude Opus model first, at a lower risk level, and then applying what is learned to make Mythos-class capabilities accessible more broadly, for cybersecurity and for everything else a model of this capability brings to general use.

The historical comparison Anthropic draws is useful context. When automated fuzz testing tools were first deployed at scale, the security community worried they would help attackers find vulnerabilities faster. They were right, but the same tools eventually became a cornerstone of defensive security infrastructure, and the software ecosystem is more secure because of them. Anthropic expects AI-driven vulnerability research to follow the same arc. The difference is that the disruption is not coming. It is here.

Conclusion

The software running our banks, hospitals, power systems, and governments has always had hidden flaws. For most of computing history, the expertise required to find and exploit those flaws was rare enough to provide a kind of passive protection. That protection is eroding, and Claude Mythos is a signal of how quickly.

The same capabilities that make this moment uncomfortable are the ones that can now be turned toward fixing decades of accumulated technical debt in the systems we all depend on. Whether that opportunity is seized by defenders or by adversaries depends significantly on how quickly the people building and maintaining critical software start treating AI as a security tool rather than something to evaluate later.