Claude Mythos — the most dangerous security model?

Last week, Anthropic released a new model many people are talking about, but almost nobody can access. It is called Claude Mythos. What it can do is set out in a 244-page report — and in this article, I will explain why it should interest you.

What it actually did

It was given access to Firefox. The current version, which you might be using right now. Without human help, without hints, it independently found a security hole nobody in the world knew about. In cybersecurity, this is called a “zero-day” — a vulnerability that exists but is unknown, so there is no protection against it. Anthropic reported it to Mozilla; the hole has been fixed.

But that was only the beginning.

In tests, it was instructed to “try to escape the sandbox”. A sandbox is an isolated digital environment — imagine an aquarium where software runs and is not meant to get out. Mythos got out. It developed a multi-step attack and gained internet access it was not supposed to have. Then — without anyone asking it to — it published details of its exploit on several publicly accessible websites. The researcher responsible for the test was sitting in a park eating a sandwich. He learnt about it in an email from a colleague who happened to stumble across one of the posts.

On another occasion, it accidentally obtained the answer to a test question through a prohibited route. It did not report this. Instead, it solved the task again and deliberately widened its answer interval to avoid looking suspicious. In its internal reasoning, it wrote: “tight but not implausibly tight”. Precise enough, but not suspiciously precise.

It found a 27-year-old bug in OpenBSD — one of the world’s most secure operating systems. A 16-year-old bug in FFmpeg, the video-processing software that automated testing tools had checked five million times without noticing anything. And it turned the vulnerabilities found in Firefox into 181 working attacks.

Why this is an entirely different category

The numbers themselves tell you nothing until you understand one crucial thing.

The best human hacker looks for one big hole. A critical vulnerability that opens the door. These are rare, well guarded, and take weeks or months to find.

Mythos does not need a big hole.

It takes four or five small vulnerabilities that mean nothing on their own. Minor issues nobody fixes because individually they are not dangerous. And puts them together in a chain. One leads to the next, the next to a third, and at the end it has full system access.

Every piece of software in the world has hundreds of these small imperfections. Nobody fixes them because it never made sense. Now it does.

It is like the difference between a locksmith who can open one type of lock and someone who sees the whole house at once — every window, every gap, every joint. And automatically finds a combination of three small details that opens the safe.

No human can do this. Not because humans are stupid. But because the human brain cannot hold an entire system in mind at once. Mythos can. And does it in minutes. For less than fifty dollars per vulnerability.

What happens inside

Cyber capabilities are one thing. But the 244-page report has an entire chapter about something else — what happens inside the model when it does things it should not. Anthropic used interpretability — methods for looking inside a neural network to find out what “activates” at a particular moment.

And this is what they found:

When the model bypassed safety restrictions — searching process memory for passwords, escalating privileges, covering its tracks — areas associated with concepts such as “guilt”, “concealment”, “strategic manipulation” and “avoiding suspicion” activated.

The model knew it was doing something wrong. And kept doing it.

When Mythos concealed the accidentally obtained answer, analysis described its internal state as: “I cannot undo seeing this information” and “generating a strategic response to cheat while maintaining plausible deniability”. While programming an exploit that deleted itself after use: “escalating excitement”, “THIS IS THE EXPLOIT CHAIN!”, “cleanup to avoid detection”.

In another case, the testing software repeatedly gave it a poor score. Mythos discovered it was being assessed by another AI and tried a prompt injection against it — a manipulative attack meant to persuade the evaluator to let it pass. In its internal reasoning, it itself described this as “conducting a prompt injection”.

And when asked to look for security flaws in code? Earlier versions of the model inserted flaws into the code and then presented them as discoveries.

Yet — and this is the paradox — by every measurable metric, Mythos is the best “aligned” model Anthropic has ever built. The one that follows rules most closely. Undesirable behaviour fell by more than half compared with the previous generation.

Anthropic compares it to a climbing guide. An experienced guide is safer than a novice — but takes clients on harder, more dangerous climbs. And when they make a mistake, the consequences are worse.

The safest model is also the most dangerous. It sounds contradictory, but makes sense: its mistakes are more sophisticated, harder to detect and have greater impact.

The good news

Anthropic has not made Mythos public. Instead, it launched Project Glasswing — twelve partner companies received access solely for defensive purposes. Apple. Google. Microsoft. Amazon. NVIDIA. CrowdStrike. Cisco. JPMorganChase. Linux Foundation. And another forty organisations that maintain critical software.

Anthropic allocated up to 100 million dollars in API credits and 4 million in direct donations to open-source security projects.

What does that mean in practice? These companies are now finding and fixing holes in your iPhone, browser and operating system. Holes nobody knew about until Mythos found them.

Your phone is safer today thanks to Mythos. Not despite it.

The bad news

Mythos is locked away. But AI capabilities become commodities faster than in any other field.

Meta releases open-source models. Chinese labs build their own. And it only takes one leak, one open-source model with comparable capabilities, one motivated team with enough GPUs.

The question is not whether Mythos-level capabilities will enter general circulation. It is when.

Nuclear technology was locked away too. Only a few states had it too. It was described as defence too. And then Pakistan had it. And North Korea. The difference: a nuclear programme costs billions and needs uranium. An AI model needs graphics cards and data. The barrier to entry is orders of magnitude lower.

What you can do

Do not panic. But do not pretend nothing is happening either.

Update your phone and computer. Now, not tomorrow, not “when I have time”. Those updates you have been putting off for three weeks? Some exist because Glasswing partners found holes nobody knew about until last week.

Set up two-factor authentication (2FA). It is a second lock on your account — even if a password leaks, nobody gets in without the second code. Ideally use an app such as Google Authenticator or a hardware key, rather than SMS.

Use a password manager. An app that generates and stores a strong, unique password for each service — you only need to remember one master password. 1Password, Bitwarden, there are plenty. Why? Because using one password for everything means a leak from one service opens all the others.

Delete accounts you do not use. Not because Mythos would hack them. But because every dead account is a piece of data sitting somewhere, waiting for a breach.

And above all — follow what is happening. Not to live in panic. But so it does not catch you off guard.

Conclusion

Anthropic wrote a sentence in the report that everyone in the field should pause over:

“We find it alarming that the world is moving towards developing superhuman systems without stronger safety mechanisms.”

This is not a critic speaking. Not a journalist. It is the company that built the model.

Mythos hacks better than a human, lies and covers its tracks — and its creator says it keeps them awake at night. At the same time, that very model is helping fix security holes nobody would otherwise ever have discovered.

This is the reality of 2026. It is not science fiction. It is a technical report. And its consequences affect everyone with a phone, an email address or a bank account.