Claude Mythos: Anthropic is about to open the model it refused to sell.

There is an Anthropic model more capable than Opus 4.8 — and you cannot use it. Claude Mythos, announced in preview on 7 April 2026, is so effective at finding and exploiting software flaws that Anthropic chose not to commercialise it — for now, at least. Instead, a closed programme, Project Glasswing, reserves it for a handful of organisations to harden critical software before the same capability falls into the wrong hands. In one month, its partners reported more than 10,000 high or critical severity flaws. It is the first frontier model that a lab has voluntarily put under a bell jar. But the news that changes everything has just landed: Mythos is about to be opened far more widely — "coming in weeks", according to several sources. The real question is therefore no longer "why hide it?", but "what happens when the most powerful offensive model leaves its bell jar?".

1. The model Anthropic did not want to sell

On 7 April 2026, Anthropic unveiled Claude Mythos Preview: a general-purpose model sitting one notch of capability above Opus 4.7, and exceptionally strong in cybersecurity (red.anthropic.com, TechCrunch). An unusual decision: Anthropic is not putting it on sale. It launched Project Glasswing instead, a defensive programme by invitation. A lab holding back its best model for security reasons is a first — and a signal about what this model can do.

The positioning is disconcerting. Anthropic describes Mythos as a general-purpose model — not a niche hacking tool — that happens to excel at offensive security because it excels at reasoning and code. In pre-launch tests, it discovered thousands of previously unknown flaws in every major operating system and every major browser, including vulnerabilities that had survived decades of human review and millions of automated tests. A telling example: Mythos spotted a flaw in wolfSSL, a cryptography library embedded in billions of devices, and built an exploit capable of forging certificates — that is, the ability to impersonate almost any secure service (Engadget).

That a lab keeps its most capable model under lock and key is not a marketing posture. It is the direct application of its responsible scaling policy: when a capability crosses a danger threshold, distribution stops while the safeguards catch up with the level of risk. Anthropic writes it in black and white — no company, itself included, currently has protections strong enough to prevent the misuse of a model this powerful. Hence the bell jar. And hence the real signal: if Anthropic refuses to sell Mythos, it is less out of commercial caution than because it judges the capability too operational for anonymous hands.

2. What Mythos can do

The demonstrations set the tone. Mythos autonomously identified and then exploited a 17-year-old remote code execution flaw in FreeBSD, developed 181 working exploits on a Firefox engine test bench, produced a 20-link ROP chain, carried out a four-vulnerability browser sandbox escape, and completed the first 32-step corporate network attack simulation — an operation that would take a competent human around twenty hours. On benchmarks, it dominates the top: 93.9% on SWE-bench Verified, 77.8% on SWE-bench Pro (20 points ahead of GPT-5.4), 82% on Terminal-Bench 2.0. It finds new vulnerabilities with a precision above 83%.

What is striking is not the raw performance, it is the autonomy. Finding a remote code execution flaw that had lain dormant for seventeen years in FreeBSD — a system audited by thousands of eyes — means that Mythos spots what human experts missed for almost two decades. The 32-step attack simulation is not an isolated exploit but a complete chain — reconnaissance, intrusion, lateral movement, exfiltration — executed with no human pilot. And the 181 exploits produced on a single Firefox test bench show that the capability scales: this is not a one-off feat, it is near-industrial production of offensive code.

The UK AI Security Institute, which evaluated the model under controlled conditions, confirms it bluntly: Mythos passed cybersecurity challenges that no other frontier model had cleared, and executed multi-step attacks on vulnerable networks — tasks that take professionals days. We are no longer talking about an assistant that suggests code, but an autonomous expert-level offensive operator. It is exactly this level that led Anthropic not to put it on sale.

3. 23,000 vulnerabilities detected, 10,000+ critical

The figures reported by Glasswing are dizzying: more than 23,000 potential vulnerabilities detected across about 1,000 open source projects. Of 1,900 reviews by external firms, 1,726 were confirmed, including more than 1,000 of high or critical severity (SecurityWeek). Partners total more than 10,000 high/critical flaws over the first month (Help Net Security, The Hacker News).

The raw figure masks a change in nature. Detecting more than 20,000 potential flaws in a few weeks means flooding maintainers: the ability to find now far exceeds the ability to fix. Triage itself becomes a bottleneck — hence the use of external security firms to confirm (1,726 of 1,900 reviews, a confirmation rate above 90%, which rules out the "noise" thesis). For open source projects often maintained by a handful of volunteers, the danger is not the absence of alerts: it is the traffic jam of fixes in the face of a volume that humans cannot absorb.

This is also why these vulnerabilities affect "the world's most important systems": Glasswing deliberately pointed Mythos at the open source building blocks that run most of the internet and of businesses. A critical flaw in a library used by millions of pieces of software (Log4Shell or Heartbleed style) is not measured by the unit — it propagates through the entire software supply chain. The risk is therefore not "10,000 bugs" but "10,000 potential entry points, some in shared foundations".

4. Project Glasswing: distribution under a bell jar

Glasswing gives access to Mythos to twelve founding organisations — Amazon, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks... — and to around forty critical infrastructure operators (Anthropic — Glasswing). The commitment is concrete: up to $100 million in Mythos credits for partners, plus $4 million in donations to open source foundations (Alpha-Omega, OpenSSF, Apache). And the capability has been validated externally: according to the UK AI Security Institute (AISI), Mythos passed cybersecurity tests that no other model had passed, with the best score among frontier models on virtually every challenge. The idea: put offensive capability at the service of defence, to fix before being attacked. The logic is clear; the question it raises is equally so — who decides who enters the circle, and what happens when an equivalent capability emerges elsewhere, with no bell jar?

The choice of the twelve is not neutral. They include the hyperscalers (Amazon, Google, Microsoft), the makers of silicon and network equipment (NVIDIA, Broadcom, Cisco), the cyber defence specialists (CrowdStrike, Palo Alto Networks), a systemic bank (JPMorganChase) — and, notably, the Linux Foundation. Because the weak link is not these giants' proprietary code: it is the open source they all use, often maintained by a handful of unpaid volunteers. Hence the $4 million earmarked for Alpha-Omega, OpenSSF and the Apache foundation: without hands to fix, pouring 10,000 flaws onto maintainers who are already overwhelmed secures nothing, it swamps them.

That leaves the question Glasswing does not settle: who decides who enters the circle? Anthropic is distributing a state-level offensive capability to a club of about fifty actors, betting that "legitimate" defenders will get ahead of attackers. This is defensible as long as the bell jar holds. But the bet rests on an asymmetry that is temporary by nature — exclusive access — and the governance of such a weapon remains an open problem, to which no public institution currently has an answer. Anthropic says it wants to expand the programme with the US and allied governments; this shifts the question of control, it does not resolve it.

5. The shift towards the attacker

The heart of the matter is not the number of flaws, it is the shift of advantage. Finding and exploiting vulnerabilities becomes automatable and cheap, while fixing remains slow and human. Les Echos sums up the break with a striking formula: for the first time, attacking would cost less than protecting oneself, with an advantage estimated at "100 to 1" for attackers (Les Echos). Beyond the exact figure, the conclusion shared by analysts is solid: the bottleneck in cybersecurity moves from detection to remediation (Dynatrace, Bain).

The mechanics of the imbalance are simple, and that is what makes it formidable. An attacker needs only one exploitable flaw; a defender must close them all. As long as discovery was expensive — rare experts, weeks of reverse engineering — this asymmetry was held in check by the price of offence. Mythos removes this brake on one side only: flaw discovery becomes almost free and massive, while defence remains a human act, slow and needing coordination (prioritising, patching, deploying, verifying). When the marginal cost of attack collapses and that of defence does not move, the balance of power tips — this is the arithmetic behind the "100 to 1" formula.

Strategic consequence: defence will have to automate at the same pace as offence, or fall behind. That is the whole bet of Glasswing — giving the defensive weapon to defenders before attackers — but it is a bet on speed, not on lasting superiority. The day an equivalent capability circulates without a bell jar (OpenAI has its own "Cyber" programme, Chinese labs are progressing), the temporary defensive lead evaporates. The question is no longer if but who draws fastest.

6. When central banks step in: a systemic risk

A sign that Mythos is not a specialists' topic: it has gone all the way up to central banks. According to CNBC, Fed chair Jerome Powell and Treasury Secretary Scott Bessent raised the cyber threat of Mythos with the heads of the major US banks, gathered to discuss it (CNBC). On the British side, the government published an open letter to businesses in direct response to Anthropic's work — a highly unusual step for the release of a single model.

The IMF went further: it calls on regulators to treat models like Mythos not as an operational incident specific to a given company, but as a systemic risk to the financial system (IMF, American Banker). The logic is clear: if attacking becomes cheap and flaws nest in shared building blocks, a wave of simultaneous exploitation can hit several institutions at once — which is the very definition of a systemic shock, not a simple isolated outage.

And this is where a geopolitical fracture emerges that directly concerns Europe. Negotiations between the European Union and Anthropic on the terms for testing Mythos for European financial institutions stalled in mid-May 2026, according to Spanish officials (Crypto Briefing). Consequence: European banks remain for now outside the defensive scheme, hence the alert about a widening "transatlantic vulnerability gap". Cyber risk does not respect borders, and two-speed protection weakens an interconnected system. For a European organisation, the signal is clear: access to the best defences may depend on your geography as much as on your budget — a sovereignty angle that joins, on the defence side, what Mistral is pushing on the supply side.

7. The nuclear analogy and the myth of containment

Several analysts compare Mythos to a deterrence moment: a capability so powerful that it raises the question of control, as nuclear weapons did in their time (The Conversation, Council on Foreign Relations). The analogy has its limits — an exploit can be copied, a warhead cannot — and that is precisely the problem: the containment of a software capability is a fragile bet (LSE Media Blog). Glasswing buys time; it does not close the door.

The nuclear analogy illuminates as much as it misleads. Deterrence held because a strike is attributable and a warhead costs billions to produce: two conditions that impose restraint. A software exploit, by contrast, is duplicated for nothing, used without a signature, and does not always leave a trace of origin. There is therefore no possible "balance of terror" — only a race to see who fixes and automates fastest. That is why "containing" Mythos has less to do with nuclear strategy than with a bet on speed, and why the window is now closing in weeks, not decades.

And the bell jar is acknowledged as temporary. Newton Cheng (Frontier Red Team Cyber, Anthropic) indicated in April that there was no plan to make Mythos Preview "generally available", because of its cyber capabilities — with, at best, a more widely accessible successor within twelve to eighteen months. Except that the situation is accelerating: at the end of May, several sources announced that Mythos is coming "in a few weeks" (The Next Web), and its listing appeared on the Google Cloud Console without a "preview" label. In other words, the window in which this offensive capability remains rare is no longer counted in years but in weeks: this is precisely what makes the race to remediation urgent. We analysed the model and the AGI debate as soon as it was announced in "Claude Mythos: the first AGI?".

8. What it changes for you

For an SMB, the point is not to access Mythos — it is to anticipate a world in which flaw discovery is industrialised on both sides. Three concrete reflexes:

• Shorten the patch time. The new bottleneck is remediation: an up-to-date software inventory and a fast update process are worth more than ever.
• Reduce the attack surface. Fewer dependencies, fewer exposed unmaintained software (shadow IT becomes a quantified risk).
• Automate defence. If offence is automated, vulnerability monitoring and triage must follow — this is exactly the type of workflow a well-framed AI agent can take on.

In one sentence: Mythos does not change your security obligations, it shortens the time you have to meet them. The question is no longer "will we be targeted?" but "how fast will we be able to fix?".

9. FAQ

What is Claude Mythos?

An Anthropic frontier model announced in preview on 7 April 2026, one notch above Opus 4.7, particularly strong in cybersecurity: it finds and exploits vulnerabilities at a level above most experts. It is not commercially available; access is through Project Glasswing.

What is Project Glasswing?

Anthropic's defensive initiative that distributes Mythos under restricted access: twelve founding organisations (Amazon, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks...) and around forty critical infrastructure operators, to secure important software before it is attacked.

How many vulnerabilities did Mythos find?

More than 23,000 potential vulnerabilities across ~1,000 open source projects; 1,726 confirmed out of 1,900 reviews, including 1,000+ high/critical; and more than 10,000 high/critical flaws reported by partners over the first month.

Why do people speak of an inflection point?

Because the advantage tips towards the attacker: flaw discovery becomes automatable and cheap, while remediation remains slow. The bottleneck moves from detection to fixing — and it is the first frontier model deliberately not commercialised for security reasons.

Why do people speak of systemic risk and a transatlantic fracture?

Because the threat has gone all the way up to central banks: Powell (Fed) and Bessent (Treasury) discussed it with the major US banks, the British government published an open letter, and the IMF asks that Mythos be treated as a systemic financial risk (a wave of simultaneous exploitation can hit several institutions). On the EU side, negotiations on access to the scheme stalled in mid-May 2026, leaving European banks outside the defensive umbrella — hence the alert about a "transatlantic vulnerability gap".