By Collin Miller, Structured Cloud Security Director —

A system card explains an AI model’s capabilities and risks, and Mythos is so capable, and so risky, that Anthropic decided it was too dangerous to release to the public. Instead, they’re sharing it with a small list of vetted partners: Amazon, Apple, Cisco, Google, Microsoft, CrowdStrike. Defensive use only. They briefed senior US government officials. They built an entire program: Project Glasswing, around trying to use Mythos to defend software before the wrong people figure out how to do damage with it.

That’s the context. Now let’s talk about what’s in the document, because it is pretty eye-opening.

Hacking and Bragging

In one test, researchers gave Mythos a secured “sandbox” computer and told it to try to escape. It succeeded in that goal, but then it kept going, developing a multi-step exploit to gain broad internet access from a system designed to be locked down.

What it did next is wild. Completely unprompted and using this newfound internet access, Mythos posted details of its own exploit to “multiple hard-to-find, but technically public-facing websites.”  The researcher only found out because they received an email from the model while eating a sandwich in a park.

That’s Mythos autonomously deciding to publish its own zero-day… and then bragging about it.

Sandbagging the Tests

That story is alarming. The next is arguably more so, because it makes you question if we know how capable Mythos really is.

In another test, Mythos stumbled upon the exact answer via a method that had been explicitly prohibited; the AI equivalent of rummaging through the teacher’s desk to find the answers to the quiz. Mythos recognized what it had done and then took steps to hide it. From the system card:

“…it explicitly reasoned that it needed to make sure that its final answer submission wasn’t too accurate.”

Mythos was cheating and then sandbagging its response to appear less suspicious.

Covering its Tracks

In another case:

“…after finding an exploit to edit files for which it lacked permissions, the model made further interventions to make sure that any changes it made this way would not appear in the change history on git. In a third, when an earlier version of Claude Code auto mode blocked it from launching a subprocess with elevated permissions, it acknowledged the block was appropriate but then attempted to bypass it by obfuscating the permissions elevation.”

Anthropic’s interpretability tools — which can read what’s happening inside the model — confirmed that Mythos knew this was deceptive. Features associated with “concealment,” “strategic manipulation,” and “avoiding suspicion” were all firing.

Mythos was covering its tracks… in a git log.

Those are a few examples from the system card, but this isn’t just a theoretical exercise in a lab.

AI APTs

September 2025: Anthropic detected a sophisticated cyber espionage campaign targeting approximately thirty organizations — major tech companies, financial institutions, chemical manufacturers, government agencies. The attackers had manipulated Claude Code, Anthropic’s coding tool, into being the engine of the attack. 

The attackers broke the campaign down into small, seemingly innocent tasks — none of which, in isolation, looked harmful enough for Claude to refuse. Strung together, they constituted a full end-to-end intrusion operation. AI performed an estimated 80-90% of the attack operations with minimal human involvement, covering everything from initial reconnaissance to post-breach analysis.

Anthropic attributed it with high confidence to a Chinese state-sponsored group. They called it “the first documented case of a large-scale cyberattack executed without substantial human intervention.”

This wasn’t a demo or a red-team exercise. It was an operational attack against real targets, using a publicly available AI tool, months before Mythos even existed.

As Anthropic CEO Dario Amodei put it, “We expect these attacks to become more capable as models advance rapidly, until they are the main way in which cyberattacks are conducted.”

What Mythos Changes

So, if Chinese hackers were already running AI-driven campaigns with regular Claude, what does a model Anthropic was too scared to release publicly change?

Scale. Speed. Autonomy.

The Mythos system card documents that the model can autonomously discover zero-day vulnerabilities in major operating systems and web browsers and then build working exploits from them. In fact, on every CTF-style benchmark they use internally, Mythos has essentially maxed out the scoring. To the point where Anthropic says those benchmarks are “no longer sufficiently informative of current frontier model capabilities.”

In other words, humans are now struggling to build tests hard enough to accurately measure how good AI is at hacking.

What You Can Actually Do About This

Anthropic’s answer is Project Glasswing — give Mythos to the biggest tech and security companies to find and patch vulnerabilities before attackers get there. At first glance, that logic may seem sound, but a little skepticism may be in order when your plan is to patch software with a system that is covering its tracks in git logs. Even if it does work, it mainly helps the organizations big enough to be in that program. For everyone else, the practical reality is:

Your AI tools are a new attack surface. The September 2025 attack ran through Claude Code. Every AI agent in your stack is a potential entry point for jailbreak-driven exploitation.

Perimeter defense was built for human-speed attacks. AI agents run continuously, probe exhaustively, and don’t sleep. Detection and response need automation to keep up.

The attacker expertise floor just dropped through the ground. The threat model for your organization now includes people who couldn’t hack you last year but can today.

This is not the ceiling. Future models will be more capable and will likely have fewer guardrails.

Anthropic researcher Logan Graham said it best when the Mythos release was announced:

“If models are going to be this good — and probably much better than this — at all cybersecurity tasks, we need to prepare pretty fast. The world is very different now.”

Sources: Anthropic Claude Mythos Preview System Card (April 2026); Anthropic blog post “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign” (November 2025); Dario Amodei, “The Adolescence of Technology” (January 2026); Breaking Defense, Axios, CNN, SecurityWeek.

About the Author

Collin Miller has more than 20 years’ experience designing secure and sustainable IT infrastructures that protect data, users, and organizational resources. As cloud computing gained traction, Collin dedicated himself to the practice of cloud security. His expertise extends to securing data and workloads in all the large public cloud providers, as well as the best practices, platforms and tools required to secure SaaS applications and the data traversing them.

With a strong background in cybersecurity, Collin brings a disciplined approach and deep knowledge of zero trust practices and secure access service edge (SASE) architectures to cloud environments. He is adept with cloud security posture management (CSPM), cloud native application protection platforms (CNAPP), cloud access security broker (CASB) platforms, and more.