The Mythos Breach: How Hackers Got Their Hands on Anthropic’s Too Dangerous to Release AI Model

The Mythos Breach: How Hackers Got Their Hands on Anthropic’s “Too Dangerous to Release” AI Model

On April 22, 2026, Bloomberg and Euronews reported what many in the cybersecurity world had feared: a group of unauthorized users had gained access to Claude Mythos Preview, Anthropic’s most powerful AI model for cybersecurity tasks — a model the company itself has called “too dangerous to release” due to its “unprecedented cybersecurity risks.”

The breach did not involve a direct compromise of Anthropic’s core infrastructure. Instead, the attackers accessed the model through a third-party vendor environment. According to a Bloomberg report citing a person employed by a third-party contractor working for Anthropic, members of a private Discord channel — dedicated to uncovering information about unreleased AI models — tried several strategies to gain access and eventually succeeded. Once inside, they began using Mythos regularly.

An Anthropic spokesperson confirmed the incident to Euronews Next: “We’re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments. There is currently no evidence that Anthropic’s systems are impacted, nor that the reported activity extended beyond the third-party vendor environment.”

But the fact that such access was possible at all raises uncomfortable questions about how the industry handles models with genuinely dangerous capabilities.

What Makes Mythos So Dangerous?

Claude Mythos Preview is not just another language model. It represents a qualitative leap in AI’s ability to find, exploit, and chain together software vulnerabilities — capabilities that Anthropic believes could destabilize global cybersecurity if widely available.

In a technical blog post on Anthropic’s red team site, researchers including Nicholas Carlini — one of the most prominent AI security researchers in the field — detailed what Mythos Preview can do:

“It has the ability to chain together vulnerabilities. So what this means is you find two vulnerabilities, either of which doesn’t really get you very much independently. But this model is able to create exploits out of three, four, or sometimes five vulnerabilities that in sequence give you some kind of very sophisticated end outcome.”

Carlini went further, stating in Anthropic’s own promotional video for the project: “I’ve found more bugs in the last couple of weeks than I found in the rest of my life combined.”

The specific findings are staggering:

• A 27-year-old OpenBSD kernel vulnerability — Mythos identified a bug in OpenBSD’s TCP stack that could crash any OpenBSD server by sending packets with invalid SACK options. The flaw had existed undetected since 1999. It was patched in the OpenBSD 7.8 errata (patch 025, dated March 25, 2026).
• Linux privilege escalation — The model found multiple vulnerabilities on Linux that allowed an unprivileged user to elevate themselves to administrator (root) simply by running a binary on their own machine.
• A full web browser exploit — Mythos wrote a browser exploit that chained together four separate vulnerabilities, including a complex JIT heap spray that escaped both the renderer sandbox and the OS sandbox.

These are not theoretical exercises. These are working exploits in production software that powers the internet’s critical infrastructure.

Project Glasswing: The Defensive Response

Anthropic announced Project Glasswing in April 2026 — a coordinated initiative to put Mythos Preview’s capabilities to work defensively. The founding partners include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks.

Access has been extended to over 40 additional organizations that build or maintain critical software infrastructure. Anthropic committed up to $100 million in usage credits for Mythos Preview across these efforts, plus $4 million in direct donations to open-source security organizations.

The financial sector has taken particular interest. According to Bloomberg, Treasury Secretary Scott Bessent convened a meeting of senior American bankers in Washington in April to discuss the Mythos model, encouraging banking executives to use it to detect vulnerabilities. Goldman Sachs, Citigroup, Bank of America, and Morgan Stanley are all reportedly testing the model.

The Supply Chain Weakness

The Mythos breach exposes a vulnerability that has nothing to do with AI and everything to do with how the tech industry manages access to sensitive systems. The attackers didn’t hack Anthropic directly — they went through a third-party vendor.

This pattern is depressingly familiar. SolarWinds, the 2020 supply chain attack that compromised multiple U.S. government agencies, followed the same playbook. The MOVEit transfer breach of 2023 affected hundreds of organizations through a single compromised file transfer tool. In each case, the weakest link in the chain determined the security of the entire ecosystem.

For a model that Anthropic considers so dangerous that it refuses to release it publicly, the fact that it was accessible through a third-party vendor environment is, as the topic suggests, humiliating. It undermines the narrative of careful, responsible deployment that Anthropic has cultivated around Mythos and Project Glasswing.

Anthropics statement that there is “no evidence” the activity extended beyond the third-party environment is reassuring but not definitive. The unauthorized group had regular use of the model after gaining access, meaning they had ample time to probe its capabilities — capabilities that include generating novel exploits for zero-day vulnerabilities.

The Security Community Is Already Overwhelmed

Even without the breach, Mythos Preview’s capabilities are reshaping the vulnerability research landscape in ways that many open-source maintainers are finding overwhelming.

Greg Kroah-Hartman, the Linux kernel maintainer, noted a dramatic shift: “Months ago, we were getting what we called ‘AI slop’ — AI-generated security reports that were obviously wrong or low quality. It was kind of funny. It didn’t really worry us. Something happened a month ago, and the world switched. Now we have real reports. All open source projects have real reports that are made with AI, but they’re good, and they’re real.”

Daniel Stenberg, creator of curl, echoed the sentiment: “The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a plain security report tsunami. Less slop but lots of reports. Many of them really good. I’m spending hours per day on this now. It’s intense.”

Security researcher Thomas Ptacek published a post titled “Vulnerability Research Is Cooked,” inspired by his podcast conversation with Carlini. The implication is clear: AI has crossed a threshold where automated vulnerability discovery is no longer a futuristic concern — it is the present reality.

What This Means for the Industry

The Mythos breach and the capabilities it revealed point to several uncomfortable truths:

• AI-powered offensive capabilities have arrived. The gap between finding a vulnerability and writing a working exploit — traditionally the domain of highly skilled security researchers — is collapsing.
• Supply chain security is the weakest link. The most carefully guarded AI model in the world can still be compromised through a third-party vendor’s inadequate controls.
• Open-source maintainers are unprepared. The volume and quality of AI-generated vulnerability reports is overwhelming the volunteer-driven maintenance model that underpins the internet’s software infrastructure.
• Defensive AI may not be enough. Project Glasswing’s strategy of giving Mythos to defenders assumes that good actors will move faster than bad actors. The breach demonstrates that bad actors are already moving.

What You Should Do Now

The implications extend far beyond a single company or a single model. We are entering an era where AI systems can autonomously discover and weaponize software vulnerabilities at a scale and speed that human defenders cannot match. The Mythos breach is not an isolated incident — it is the first crack in a much larger dam.

Whether you’re a developer, a security professional, or simply someone who relies on software (which is to say, everyone), the Mythos breach and the capabilities it represents should prompt immediate action:

• Update everything. The vulnerabilities Mythos has found in Linux, OpenBSD, and web browsers are being patched, but the patch window between disclosure and exploitation is shrinking to days or hours.
• Audit your third-party access. If your organization grants external vendors access to sensitive systems or data, review those permissions now. The Mythos breach is a reminder that your security is only as strong as your least secure partner.
• Invest in automated patching. Human-driven vulnerability response cannot keep pace with AI-driven vulnerability discovery. Organizations need automated testing, CI/CD-integrated security scanning, and rapid deployment pipelines.
• Support open-source security funding. The maintainers of Linux, curl, OpenSSL, and thousands of other critical projects are being flooded with AI-generated reports they lack the resources to triage. Projects like the Open Source Security Foundation (OpenSSF) need more support.

The Bottom Line

Anthropic built a model so capable at finding and exploiting software vulnerabilities that it chose not to release it to the public. Then hackers got access to it anyway — not through a sophisticated attack on Anthropic’s own systems, but through the same old weak link: a third-party vendor.

The breach is particularly ironic given that Project Glasswing’s entire mission is to strengthen cybersecurity. Anthropic assembled some of the world’s most security-conscious companies — Apple, Google, Microsoft, CrowdStrike, Palo Alto Networks — and committed $100 million to the cause. Yet the model at the center of this billion-dollar defensive effort was itself compromised through a vendor that apparently lacked basic access controls.

Project Glasswing’s strategy of giving Mythos to defenders assumes that good actors will move faster than bad actors. The breach demonstrates that bad actors are already moving, and they may already be ahead. With the unauthorized group reportedly having regular, sustained access to the model, the window for potential damage was significant.

In cybersecurity, the offense only needs to win once, while the defense needs to win every time. With AI tipping the balance toward the offense, the industry needs to move faster than it ever has before.

The Mythos breach wasn’t just embarrassing for Anthropic. It was a warning shot for the entire technology sector. The question isn’t whether AI will transform cybersecurity — it already has. The question is whether we can adapt fast enough to survive the transformation.

📖 Related: Anthropic’s Too Dangerous AI Model Mythos Breached on Day One – Here’s What Went Wrong

📖 Related: The $200 vs. $0 Showdown: Why Developers Are Ditching Claude Code for Open-Source Goose

📖 Related: Anthropic’s Mythos Breach Was Humiliating — And It Should Terrify the AI Industry