Anthropic’s new Claude Mythos Preview model can autonomously find and exploit zero-day and N-day vulnerabilities across major OSes and browsers. In testing, it produced sophisticated exploits—from JIT heap sprays to multi-packet ROP chains—and outperformed prior models by a wide margin. Project Glasswing will share these capabilities with select partners to shore up defenses before wider release.

• Claude Mythos Preview autonomously found and exploited a 27-year-old OpenBSD bug and chained four browser flaws into a JIT heap spray exploit, plus RCE on FreeBSD's NFS server via a 20-gadget ROP chain split across packets
• On Firefox JS engine trials, it produced 181 working shell exploits versus Opus 4.6's 2 successes in hundreds of attempts
• On OSS-Fuzz benchmarks (~7,000 entry points), it achieved full control-flow hijack (tier 5) on ten patched targets, where prior models never exceeded a single tier 3 crash
• These exploitation abilities emerged as a side effect of general code reasoning improvements, not targeted exploit training, prompting Anthropic to share the model early with defenders via Project Glasswing