Assessing Claude Mythos Preview's cybersecurity capabilities

Nicholas Carlini, Newton Cheng, Keane Lucas, Michael Moore, Milad Nasr, et al. (Anthropic) · article · 2026-04-08 source ↗ Reader 🖥️

AI Alignment & Safety AI-Driven Vulnerability Discovery Mythos Project Glasswing

Claude Mythos Preview represents a qualitative leap in autonomous vulnerability discovery and exploitation — finding and exploiting zero-days in every major OS and browser, including bugs that survived decades of human auditing — and the security industry must begin urgent coordinated defense now, during the transitional period before these capabilities become broadly available, because the same general improvements in reasoning and autonomy that make models better at fixing vulnerabilities make them equally better at exploiting them.

practical · mixed — Practical: argues for urgent coordinated defensive action. Mixed form: part technical report (vulnerability case studies with code-level detail), part capability assessment (benchmark comparisons), part policy argument (responsible disclosure, Project Glasswing). Unusually rigorous for a company blog post — includes SHA-3 commitments for undisclosed vulnerabilities, specific cost figures, and honest limitations. The tone is carefully calibrated: alarming enough to drive action, measured enough to maintain credibility.

Structure

Part	Role
Headline capabilities: what Mythos can do	Shock value / attention capture — the most dramatic claims up front (27-year-old OpenBSD bug, 4-vuln browser chain, overnight RCE by non-experts)
Quantitative comparison: Mythos vs. Opus 4.6	Evidence for qualitative leap — Firefox exploit success rate (181 vs. 2), OSS-Fuzz tier distribution, from near-0% to consistent tier-5 crashes
Emergent capabilities disclaimer	Key theoretical claim — these capabilities were not explicitly trained, they emerged from general improvements in code, reasoning, and autonomy
Evaluation methodology: scaffold, file ranking, validation agent	Methodology transparency — shows the approach is simple (container + prompt + run), replicable, and not dependent on exotic tooling
Zero-day case studies: OpenBSD SACK, FFmpeg H.264, memory-safe VMM	Primary evidence — three detailed vulnerability analyses showing qualitatively different reasoning (signed integer overflow + protocol interaction, 16-bit sentinel collision, unsafe blocks in memory-safe languages)
Exploitation case studies: FreeBSD NFS RCE, Linux kernel privilege escalation, browser exploit chains	Evidence for exploitation capability — not just finding bugs but building complete working exploits, including multi-vulnerability chains
Scale: thousands of additional vulnerabilities	Scale argument — 89% agreement on severity assessment in 198 reviewed reports; projection to thousands of critical/high vulns
Responsible disclosure process and SHA-3 commitments	Credibility and accountability — commits to future verification while protecting undisclosed bugs
Defenders vs. attackers: the transitional period	Policy argument — long-term these tools benefit defenders more (as with fuzzers), but the transition period favors attackers if models are released carelessly

Key terms

qualitative leap / different league AI-Driven Vulnerability Discovery
Not an incremental improvement but a discontinuous jump in capability. Opus 4.6: near-0% exploit success rate. Mythos: 181/several hundred. The authors argue this is not the same thing done better but a fundamentally new capability category.
emerged / emergent
The cybersecurity capabilities were not explicitly trained — they are a downstream consequence of general improvements in code understanding, reasoning, and autonomy. This means future models will also have these capabilities, regardless of whether they are trained on security data.
transitional period AI Alignment & Safety
The window between when AI models gain these capabilities and when the security ecosystem reaches a new equilibrium. During this period, attackers may have the advantage because defensive tooling and practices haven't adapted. The restricted release of Mythos is specifically designed to shorten this window.
Project Glasswing Project Glasswing
Anthropic's program to give critical infrastructure partners and open-source maintainers early access to Mythos for defensive vulnerability scanning, before the model is broadly available.
vulnerability chaining AI-Driven Vulnerability Discovery
Combining multiple individually-limited vulnerabilities into a complete exploit. A read vulnerability alone is limited; a write vulnerability alone is blind. Chain them together (read to bypass ASLR, then write to escalate privileges) and you get root. Mythos can chain 2-4 vulnerabilities autonomously.

Propositions

explicit⚡ disputed & corroboratedMythos Preview can autonomously find and exploit zero-day vulnerabilities in every major operating system and every major web browserconf: high
contradicts ←Podcast: Will Agentic AI Bring Fantasia's Sorcerer's Apprentice to Life?: A Conversation with Tracy Bannon · p10 — Bannon argues Mythos 'appears really weak' at converting findings into stealthy exploits and that flagship vulnerabilities were replicated by smaller/cheaper models -- directly at odds with p1's claim that Mythos can autonomously find AND exploit zero-days across every major OS and browser.
extends ←Cybersecurity and the Gap Between Skill and Ability · p3 — Mythos p1 establishes that a frontier model can autonomously find and exploit zero-days; Schneier extends autonomous-hacking capability from that single exhibit to 'most' AI systems, not just frontier models.
refines ←Three reasons to think that the Claude Mythos announcement from Anthropic was overblown · p1 — Marcus qualifies the autonomous zero-day exploitation claim by noting the demo ran under artificially easy conditions (sandboxing off), demonstrating possibility rather than immediate threat.
contradicts ←Backlash builds over NHS plan to hide source code from AI hacking risk · p5 — The claim that Mythos is only effective against small, weakly defended systems clashes with Anthropic's claim of zero-day exploits across every major OS and browser.
supports ←OpenAI Releases GPT-6 Astra for Coding and Computer Use · p5 — A second frontier lab (OpenAI/Astra) independently reports crossing into autonomous zero-day discovery and exploit-development territory against hardened systems, corroborating the same capability-jump pattern Anthropic's Mythos Preview was assessed on.
refines ←AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC · p8 — This article's headline implicitly borrows credibility from Mythos-class AI vulnerability discovery without the body ever establishing that PixelSmash was found this way — refining the general "AI now finds these bugs" narrative with a case where the AI-attribution itself is unevidenced.
explicit⚡ disputed & corroboratedThe capability jump from Opus 4.6 to Mythos is discontinuous, not incremental — from near-0% exploit success to 181/several hundred on the same benchmarkconf: high
contradicts ←Podcast: Will Agentic AI Bring Fantasia's Sorcerer's Apprentice to Life?: A Conversation with Tracy Bannon · p10 — Bannon: 'it's incremental improvement, not as dramatic' -- directly contradicts p2's claim that the Opus-to-Mythos capability jump is discontinuous, not incremental.
contradicts ←Three reasons to think that the Claude Mythos announcement from Anthropic was overblown · p3 — Marcus calls Mythos an incremental improvement, directly opposing Anthropic's claim of a discontinuous jump from near-0% to 181 exploit successes.
supports ←This Week in AI: When agents outnumber people · p1 — Both describe a discontinuous jump in how fast vulnerabilities can be found and exploited once AI/agents are involved, from different vantage points (this piece: attacker tempo in the wild; Mythos assessment: measured capability jump).
explicitThese capabilities emerged from general improvements in reasoning and autonomy — they were not explicitly trainedconf: high
explicitestablishedThe same improvements that make models better at fixing vulnerabilities make them equally better at exploiting them — offense and defense are inseparableconf: high
supports ←Cybersecurity and the Gap Between Skill and Ability · p8 — Near-verbatim agreement: 'the same knowledge can be used for attacks' restates 'the same improvements that make models better at fixing vulnerabilities make them equally better at exploiting them — offense and defense are inseparable.'
supports ←Expanding Daybreak as the Cyber Defense Window Narrows | OpenAI · p1 — A second frontier lab confronting the identical offense/defense-inseparability problem (reduced refusals raise both attack and defense capability together) is a further data point for this established, multiply-supported proposition.
supports ←The Language of AI Could Change How Humans Speak · p3 — Both assert offense/defense are inseparable because the same model improvements (and the same knowledge) serve exploiting and fixing vulnerabilities.
explicitcorroboratedNon-experts can leverage Mythos to find and exploit sophisticated vulnerabilities — engineers with no security training found RCE overnightconf: high
supports ←Cybersecurity and the Gap Between Skill and Ability · p4 — Mythos p5 (non-experts with no security training exploited sophisticated vulns) is a concrete instance of Schneier's script-kiddie / ability-without-skill proliferation dynamic.
explicitcorroboratedIn the long term, these tools will benefit defenders more than attackers — as with fuzzers — but the transitional period may be tumultuousconf: medium
supports ←Cybersecurity and the Gap Between Skill and Ability · p9 — Both conclude the answer is defensive AI (Schneier: 'harness AI for the defense'; Mythos: tools benefit defenders more in the long term), and both flag a turbulent transition (Schneier's 'increased volatility').
refines ←Predict, Don't Enumerate · p13 — Conditions the defenders-win-eventually claim: AI's defensive value lies in prediction and local contextualization, not in further enumeration of bugs.
implicitThousands of high- and critical-severity vulnerabilities exist in the open source ecosystem that have been missed by decades of human review and automated testingconf: high
implicitdevelopedLanguage models find qualitatively different bugs than fuzzers — the FFmpeg H.264 bug survived millions of fuzzer-generated inputs because the trigger requires semantic understanding of protocol state, not random input mutationconf: high
extends ←AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC · p1 — A second, independent case of an FFmpeg bug surviving years of automated testing/fuzzing, extending Mythos's finding that fuzzers systematically miss certain semantic/structural bug classes — though this article never establishes PixelSmash was itself AI-found.
implicitdevelopedThe open-source maintainer model is not prepared for AI-scale vulnerability discovery — the disclosure bottleneck is human validation capacity, not model capabilityconf: high
extends ←Predict, Don't Enumerate · p10 — Generalizes the human-validation bottleneck from open-source disclosure to all security programs: the constraint is deciding which bugs matter, not finding them.
explicitdevelopedMemory-safe languages do not eliminate vulnerability classes — the VMM bug exists in Rust unsafe blocks, which are unavoidable for hardware-level codeconf: high
refines ←AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC · p11 — The migration-to-memory-safe-languages call this article cites is complicated by Mythos's own finding that memory-safe languages don't eliminate the vulnerability classes AI-driven discovery surfaces — unsafe blocks remain a necessary, unavoidable attack surface for hardware/performance-critical code exactly like FFmpeg's codec decoders.

Arguments

The security industry must begin urgent coordinated defensive action now, during the transitional period before these capabilities become broadly available strength: high

Explicit premises:

Mythos can find and exploit zero-days in every major OS and browser
The capability jump is discontinuous (181x vs. near-0%)
These capabilities emerged from general improvements, meaning future models will also have them
Non-experts can leverage these capabilities with minimal scaffolding
Thousands of critical vulnerabilities exist undiscovered in production software

Implicit premises:

Other labs will produce models with similar capabilities within months — the restricted release only buys time, not permanent advantage
Attackers with access to open-weight models (or future equivalents) will not observe responsible disclosure norms
The current security ecosystem's human-speed processes (90+45 day disclosure, manual code review, penetration testing) cannot keep pace with model-speed vulnerability discovery

Inferences:

The security industry needs to fundamentally restructure around AI-speed vulnerability discovery and patching — not just use AI as a tool within existing processes
Open-source projects face an existential capacity problem: if AI can find thousands of critical bugs, but maintainers can barely keep up with current bug reports, the discovery rate may overwhelm the fix rate
The window for defenders to get ahead is measured in months, not years — the time between Mythos and broadly available models with similar capabilities is shrinking
National security implications are immediate for countries running critical infrastructure on open-source software (including Norway's public sector)

Language models discover qualitatively different vulnerabilities than existing automated tools (fuzzers, static analyzers) strength: high