This week, Anthropic announced Claude Mythos Preview, a frontier model it says has reached a level of coding capability that allows it to “surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” The company further stated that it had already identified thousands of zero-day vulnerabilities across every major operating system and web browser, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg.
Citing the risk of bad actors exploiting these same capabilities, Anthropic is limiting access to a curated group of major tech and financial firms, including Amazon, Apple, Microsoft, Google, JPMorganChase, and roughly 40 others, under a new initiative called Project Glasswing, backed by $100 million in usage credits. According to some reports, the announcement prompted Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell to convene an emergency meeting with the CEOs of Citigroup, Morgan Stanley, Bank of America, Wells Fargo, and Goldman Sachs to discuss the systemic risks the model poses to the financial system.
However, the panicked reaction may warrant skepticism. AI companies have a documented pattern of warning loudly about the dangers of their own technology, a dynamic critics say is motivated by the desire for regulatory capture. The specific cybersecurity claims around Mythos have also gotten pushback. Researcher Boyan Milanov called Anthropic’s claims “largely unsubstantiated” and said there was no evidence Mythos meaningfully outperforms prior models at vulnerability discovery rather than exploitation. Another commentator pointed out that Mythos's full-exploit rate drops to 4.4% once two repeated bugs are removed, implying four distinct bugs total rather than the fifty the model card implies. So while it’s no doubt true that AI will pose security issues as it continues to improve, the hype around Mythos may have more to do with its marketing than with the underlying reality.
