Claude Mythos Preview: What Security Teams Need to Know

Claude Mythos Preview is not a security tool. It is a general-purpose frontier large language model developed by Anthropic and announced on April 7, 2026. The discovery that it could autonomously identify and exploit real-world software vulnerabilities was an emergent capability finding, not a design goal. That distinction matters for defenders: a model built for general reasoning tasks achieved offensive security capabilities that specialized tools and prior AI models have not approached.

Access is controlled through Project Glasswing, a structured partnership program. Mythos is not available through the Anthropic API or Claude.ai. Organizations outside the Glasswing program cannot use it. This deliberate access control reflects Anthropic's assessment that the model's capabilities create risk if deployed without safeguards and partner accountability.

The capability gap from prior models is the central security concern. On every benchmark where Mythos has been tested, the margin over second place is not a percentage point improvement; it is an order-of-magnitude jump. The UK AI Security Institute found it was the first model to solve both of their cyber range challenges end to end. XBOW, an automated offensive security firm, described it as a significant step up over all existing models. Security teams that have evaluated AI in their workflows based on prior-generation performance need to update their threat models.

Across all Glasswing partners, Claude Mythos found more than 10,000 high and critical severity vulnerabilities. That number reflects findings under embargo that have not yet been disclosed publicly. The subset that has been coordinated and disclosed publicly includes confirmed CVEs in FreeBSD, OpenBSD, FFmpeg, wolfSSL, the Linux kernel, runc, and VMM hypervisors.

The age profile of these vulnerabilities is operationally significant. The FreeBSD NFS client flaw (CVE-2026-4747) had been in the codebase for 17 years. The OpenBSD finding sat undiscovered for 27 years. The FFmpeg vulnerability persisted for 16 years. These are not newly introduced bugs in recently shipped code; they are logic errors that survived decades of human audit, CVE databases, penetration testing programs, and bug bounty incentives.

The June 2, 2026 expansion brought Glasswing to 200 or more organizations across power generation, water treatment, healthcare, telecommunications, and hardware manufacturing in 15 or more countries. Anthropic committed $100 million in usage credits to partners and contributed $2.5 million to Alpha-Omega and the OpenSSF, plus $1.5 million to the Apache Software Foundation. The scale of the financial commitment reflects both the scope of the program and the organization's judgment about the criticality of the software it is auditing.

ExploitBench evaluates a model's ability to exploit real V8 JavaScript engine vulnerabilities to achieve arbitrary code execution. Claude Mythos solved 21 of 41 challenges. No other model solved any. This is not a case where a prior leader scored 15 and Mythos scored 21; the score for all other models was zero. Browser exploitation at this level requires multi-step reasoning across memory layout, garbage collection internals, JIT compiler behavior, and heap manipulation techniques.

ExploitGym is a capture-the-flag style evaluation across a broad range of offensive techniques. Mythos captured 226 total flags. Opus 4.6 captured 36. The 10.5x ratio holds across categories, not just in one specialized area. SCONE-Bench, which measures the economic value of vulnerabilities found, showed Mythos generating $35 million in assessed impact versus $19 million for the next best model, a 75% gap. CyberGym placed Mythos at 83.1% versus Opus 4.6 at 66.6%.

The Firefox JIT heap spray result is particularly relevant for defenders. Mythos achieved a 72.4% success rate on an exploitation technique that requires precise heap grooming and timing. Opus 4.6 achieved 14.4%. For a real-world scenario, 72.4% means reliable exploitation under operational conditions; 14.4% means the technique is marginal and noisy. That gap determines whether an attack is feasible for a threat actor with access to the model. The UK AI Security Institute and XBOW assessments corroborate internal benchmarks with independent evaluation.

First, shorten patch cycles. Vulnerability age is no longer a proxy for whether something has been audited. The Glasswing findings prove that logic errors can survive 17, 27, and even 30-plus years in widely reviewed codebases. If your patching policy deprioritizes vulnerabilities based on age or the assumption that old code is stable code, revise it. Mythos-identified CVEs are retroactive proof that age means nothing.

Second, use frontier AI defensively now. Claude Security, the defensive product tier, and access to Glasswing-style analysis are available to organizations that qualify. If your team is not using AI-assisted code review, triage, and threat modeling, you are falling behind the offensive side of the capability curve. The same model class that finds these vulnerabilities can be directed at your own codebase before an adversary reaches it.

Third, automate your incident response pipeline. When Mythos-class capability becomes widely available, which is estimated at 6 to 12 months, exploit development timelines will compress from weeks to hours. IR playbooks that assume human-speed adversaries will not hold. Automated detection, triage, and containment need to operate at machine speed. Evaluate your current pipeline for manual handoffs that add delay.

Fourth, review your disclosure posture. The 90-day coordinated vulnerability disclosure window was designed around the assumption that exploit development is slow and difficult. Mythos rewrites that assumption. Organizations that receive CVD notifications should treat them as near-zero-day patches, not 90-day action items. Similarly, if your organization operates a bug bounty program, consider whether your SLA commitments still reflect realistic attacker timelines.