Anthropic says its new model, Mythos Preview, is a big jump in AI cyber capability, so instead of releasing it broadly it is giving controlled early access to defenders through Project Glasswing. The goal is to find and patch vulnerabilities before similar models spread.

• Cyber capability in AI models has been rising for years as a side effect of better coding ability, and Mythos Preview is a notably large step up.
• Anthropic chose not to release Mythos Preview generally, giving selected defenders early access to find and fix vulnerabilities first.
• Project Glasswing brings many major companies together to address the cyber risks posed by increasingly capable AI systems.

A US official told AP that Anthropic’s Mythos model identified vulnerabilities in classified government systems within hours during Project Glasswing tests with intelligence agencies. The Trump administration then barred foreign access to Mythos and its limited Fable 5 model under a security directive, prompting cybersecurity experts to warn that restricting these tools could weaken US defenses.

• Anthropic's Mythos model found vulnerabilities across nearly all tested classified US government systems in hours, not weeks, per NSA/Cyber Command head Gen. Joshua Rudd
• The Trump administration barred foreign nationals from accessing Mythos 5 and Fable 5, and Anthropic responded by disabling the models for all customers, not just foreign users
• Over 100 cybersecurity leaders (including Adobe and Nvidia executives) are pushing to reverse the ban, arguing Mythos isn't uniquely capable—other models do similar security auditing—and restricting it could weaken US defenses against rival states

Anthropic released Claude Fable 5, a Mythos-class model with conservative safeguards that excels at long-context reasoning, software engineering, vision, knowledge work, and life-science research. A restricted-lifted variant, Claude Mythos 5, is available to vetted cyberdefense partners under Project Glasswing. Both are priced at $10 per million input tokens and $50 per million output tokens and lead benchmarks across multiple domains.

• Stripe used Fable 5 to migrate a 50-million-line Ruby codebase in one day, a job that would've taken a team two months
• Fable 5 and Mythos 5 cost $10/million input and $50/million output tokens, under half the previous Mythos Preview price
• Mythos 5 matched or beat expert scientists across all protein-engineering steps in a blind test, yielding nine drug candidates now under investigation
• Cybersecurity safeguards on Fable 5 silently reroute sensitive queries to Opus 4.8 in under 5% of sessions, while Mythos 5 drops those restrictions for vetted cyberdefense partners under Project Glasswing

Anthropic’s new Claude Mythos Preview model can autonomously find and exploit zero-day and N-day vulnerabilities across major OSes and browsers. In testing, it produced sophisticated exploits—from JIT heap sprays to multi-packet ROP chains—and outperformed prior models by a wide margin. Project Glasswing will share these capabilities with select partners to shore up defenses before wider release.

• Claude Mythos Preview autonomously found and exploited a 27-year-old OpenBSD bug and chained four browser flaws into a JIT heap spray exploit, plus RCE on FreeBSD's NFS server via a 20-gadget ROP chain split across packets
• On Firefox JS engine trials, it produced 181 working shell exploits versus Opus 4.6's 2 successes in hundreds of attempts
• On OSS-Fuzz benchmarks (~7,000 entry points), it achieved full control-flow hijack (tier 5) on ten patched targets, where prior models never exceeded a single tier 3 crash
• These exploitation abilities emerged as a side effect of general code reasoning improvements, not targeted exploit training, prompting Anthropic to share the model early with defenders via Project Glasswing

Anthropic is holding back its new AI model, Claude Mythos Preview, and teaming up with over 40 tech firms to hunt and patch security flaws in critical software. The company says the model can autonomously find zero-day vulnerabilities that have eluded researchers for decades, raising fresh concerns about AI-driven cyberattacks.

• Anthropic is withholding public release of Claude Mythos Preview and instead giving early access to ~40 companies (Apple, Amazon, Microsoft, Google, Cisco, Broadcom, Linux Foundation) under "Project Glasswing," backed by up to $100 million in usage credits, to find and patch critical software vulnerabilities first.
• The model has reportedly found a 27-year-old vulnerability in OpenBSD and a flaw in video software that survived five million automated scans, using simple prompts to autonomously hunt zero-days.
• Anthropic frames this as a security "reckoning" while simultaneously racing toward projected revenue of $30 billion this year, mirroring the tension of building powerful AI it also warns could enable dangerous cyberattacks.