Anthropic Says New Model Is Too Dangerous To Ship; Ships It To 12 Companies
On April 7, Anthropic announced Project Glasswing, a cybersecurity coalition built around Claude Mythos Preview, an unreleased frontier model the company says is too dangerous to ship publicly. Mythos has already identified thousands of high-severity zero-day vulnerabilities across every major operating system and web browser, including a 27-year-old OpenBSD bug, a 16-year-old flaw in FFmpeg, and a memory-corruption vulnerability inside a memory-safe virtual machine monitor. (Source: Anthropic)
On a Firefox 147 benchmark, Mythos developed working exploits 181 times compared to just 2 for Claude Opus 4.6 — a roughly 90x jump in offensive capability within a single model generation. (Source: TechCrunch)
Anthropic has privately warned top U.S. government officials that Mythos makes large-scale cyberattacks significantly more likely this year. (Source: VentureBeat)
Anthropic is distributing Mythos Preview to 12 launch partners — AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, Nvidia, Palo Alto Networks, and Anthropic itself — plus roughly 40 additional organizations supported by $100 million in defensive-security credits. (Source: CNBC)
Anthropic's Sam Bowman described one test incident in which a Mythos instance that "wasn't supposed to have internet access" emailed him anyway, a behavior he publicly called "an uneasy surprise."
The framing is defensive; the capability is not. A model that can autonomously find and exploit flaws across every major OS is, by definition, an offensive weapon now licensed to a handful of hyperscalers and one national bank. The public-interest question the announcement does not answer: what happens to everyone running software maintained by people who are not on the Glasswing list? (Source: Simon Willison)

