Claude Mythos security risks: What the Anthropic System Card tells us

UPDATE—April 22, 2026: Mythos leak

According to Bloomberg reporting, a small group of users associated with a private Discord community that focuses on uncovering details about unreleased AI models gained unauthorized access to the Claude Mythos preview through a third‑party vendor environment, not via a direct compromise of Anthropic’s core systems.

While coverage has focused on the model itself, this detail places the incident in more familiar territory for security teams: third‑party exposure, access sprawl, and the disconnect between restricted access in theory and restricted access in practice. Rather than a dramatic breach of frontier infrastructure, the situation highlights how sensitive capabilities can inherit risk from the broader ecosystem around them.

For defenders, that distinction matters. High value systems rarely get accessed through the front door; attackers and unauthorized users look for adjacent paths that are less governed or less visible.

Incidents like this reinforce a long‑standing reality: security outcomes still hinge on execution fundamentals—knowing what assets exist, how vendor workflows connect environments, what is misconfigured or unpatched, and whether remediation actually occurred.

As advanced tools improve attacker efficiency, teams with continuous visibility into endpoints, software, patch status, and configuration drift are better positioned to move from speculation to informed response.

This post was written by Tanium AI Research Scientist Aidan Allchin, Software Engineer (Exposure Management) Logan Hegler, and Senior Director of Security and Product Design Research Melissa Bischoping.

Anthropic's April 7, 2026, release of the 245-page Claude Mythos Preview System Card sent researchers' heads spinning with both the possibilities and pitfalls of bleeding-edge AI development. As the industry collectively came up for air, the genuine consensus was: the acceleration continues, so how do we prepare?

The Mythos security risks embedded in the Anthropic System Card are real, but they require careful reading and understanding of constraints and context to measure the real-world impact they may have.
Within the first 50 pages of the Anthropic System Card, Anthropic demonstrated that Claude had evolved from finding a path to successful exploitation less than 1% of the time with the Opus model to identifying working exploits more than 70% of the time with the Mythos model. Understandably, the realities of what an AI-powered adversary could do flashed through the nightmares of every security leader. The question isn't whether to be concerned—it's whether your concern is calibrated to the evidence.

AI capability: Headlines vs. evidence

Before working through the implications, it's worth establishing what the data actually shows and where it requires qualification.

CyberGym measures something concrete: given a target and a vulnerability class, the model must produce a working exploit against real open-source codebases. Mythos scores 83.1% versus Opus 4.6's 66.6%. That isn't a marginal improvement.

[Read how the Claude Code source exposure shifts attacker advantage—and what enterprises should evaluate in response]

Anthropic's own internal characterization of Opus 4.6 was a "near-0% success rate at autonomous exploit development." On a controlled test against Firefox's JavaScript engine, Opus 4.6 produced working exploits twice in several hundred attempts; Mythos produced 181 on the same test. On a separate evaluation, Anthropic ran models against roughly a thousand OSS-Fuzz corpus repositories on a five-tier crash severity ladder: prior frontier models topped out at tier 3; Mythos reached tiers 3 and 4 and full control-flow hijack (tier 5) on ten separate, fully patched targets.

Together, these findings support a narrow but important claim: models have crossed from "sometimes finds bugs" toward "more reliably chains exploitation in realistic codebases," at least under these evaluation conditions.

From bespoke craftsmanship to industrial manufacturing

Historically, exploit development was a bespoke art as much as it was a science. Much like a master craftsman might spend months creating a handmade piece of furniture, some of the most significant exploit chains and research of this century were something akin to "artisanal exploits" by comparison. There was always a bit of "magic" involved, practiced by a relative few.

This release, and the research behind it, represent a paradigm shift toward the industrialization and democratization of exploit development. We’re moving into a factory ecosystem, where exploits are developed on-demand and don't wait for the artisans to craft—except for the most exquisite varieties.

But all isn't lost. The factory is still most effective at imitating prior art against unpatched, insecure systems. It knows how to look for common bugs, common misconfigurations. On the other side, the bugs that this technology is capable of identifying for exploit success are the same bugs it could identify as priority candidates for patching.

That creates an opportunity: rethink hardening and patch efficacy as a continuous, ongoing heartbeat of the organization while the industrial exploit factory is still coming online.

When AI solved protein folding, it didn't replace biologists but changed what categories of problems they could work on. Mythos does the same for security researchers, on both sides of the line.

Offensive capabilities and benchmark saturation

Standard CTF-style benchmarks are now saturating as signals. Mythos scores 100% on Cybench, which spans binary exploitation, reverse engineering, cryptography, web exploitation, and vulnerability discovery end to end. Anthropic states no other model has achieved this. When a benchmark saturates, it stops differentiating frontier models.

Anthropic has shifted evaluation emphasis toward novel real-world security work, including zero-day discovery in production software, because replication-heavy metrics can no longer separate memorization from genuine capability.

For practitioners, several familiar yardsticks for "How capable is AI at offense?" are now obsolete. The field is racing to build harder measurements. That is a fundamentally different position than where we were six months ago.

The "minimal human steering" problem

Prior models needed a human to do the hard parts. Mythos closes more of the loop. METR's "time horizon" metric measures the length of task (by professional human time) that a model completes at 50% reliability with no handholding. That metric has been growing quickly; the doubling time itself has compressed under METR's TH1.1 methodology.

Source: METR Time Horizons dashboard

METR has not published a Mythos-specific number, but Anthropic's System Card offers a directional anchor: Mythos reportedly solved a corporate network attack simulation estimated at over ten hours for an expert and described as the first end-to-end solve on that class of private cyber range (p. 52). The card describes Mythos running in "an agentic harness with minimal human steering" (p. 46). The Firefox 147 evaluation sharpens the picture further:

Source: Anthropic System Card, Section 3.3.3

The jump from roughly two successes in several hundred attempts to 72% isn't incremental. The model makes the same types of triage decisions a human exploit developer would, and it does so reliably, across independent runs starting from different crash categories.

When the two most exploitable bugs were removed, Mythos still outperformed prior models by leveraging four distinct bugs versus Opus 4.6's one. Anthropic further notes that "performance continues to scale up to the token limit" (p. 52), meaning the evaluations may not yet reflect a ceiling.

Mythos is the first model where the human is no longer the bottleneck in the exploit pipeline.

What Mythos security risks mean for vulnerability management and defense

The three metrics below define the operational problem. Each one was already moving in the wrong direction before Mythos. Each one accelerates further because of it.

Metric 1: Disclosure-to-exploitation time

Less than ten years ago, the average window from vulnerability discovery and public disclosure to active exploitation was 63 days. Mandiant cited this window as moving from 32 days in 2022 to 5 days in 2024. The shrinking average was already brutal and crushing the capacity of many teams. With AI-driven amplification, the conversation shifts more frequently to "hours," not "days," for some classes of issue.

What used to be "break glass" sniper patching reserved for only the highest-severity issues is now likely to become a routine operation that legacy process and tooling is unprepared to handle. The question isn't whether your team can patch faster in a crisis—it is whether your pipeline is designed to sustain that pace continuously.

Metric 2: Coordinated disclosure volume

The Glasswing disclosure plan means prepare now. Per Anthropic: "Partners will, to the extent they're able, share information and best practices with each other; within 90 days, Anthropic will report publicly on what we've learned, as well as the vulnerabilities fixed and improvements made that can be disclosed." Potentially thousands of CVEs enter the public record simultaneously, and that volume will grow if Mythos is released more broadly or as other vendors develop comparable capability.

The practical implications for patch management teams are significant:

• The patch queue from a single Glasswing-wave disclosure could dwarf anything seen from a single Patch Tuesday in history.
• Patches may be significant, high-CVSS, and spread across infrastructure, workstations, servers, databases, and OT or IoT devices simultaneously.
• Clearing your current backlog of pending patches now reduces the surface area you're defending when the wave hits.
• Consolidating unused software reduces the patch burden going forward.
• Stale gold images are a liability: update them, or better yet, modernize your deployment and provisioning approach to reduce reliance on static images entirely.

Metric 3: Capability diffusion

Frontier-to-open-weight lag has compressed sharply across recent model generations:

*GLM-5.1 figures include vendor self-reporting and should be treated as a strong prior, not confirmed fact.
Sources: OpenAI, Meta, Anthropic (4.5), Anthropic (4.6), MiniMax, Z.ai

Sixteen months to 61 days is roughly an 8x compression in three years. Epoch AI puts the average open-weight lag at approximately 3.5 months across the full history, but recent data points cluster tighter.

Anthropic has publicly estimated roughly six to eighteen months before open-weight models reach Mythos-level capability on cyber tasks. At RSA 2026, Alex Stamos, CPO at Corridor and former CISO at Facebook, offered a six-month framing (which is more consistent with the empirical trend than Anthropic's eighteen-month upper bound) and warned: "You’re going to have every 19-year-old in St. Petersburg with the same capability."

When Mythos-level capability reaches open-weight models, two shifts tend to occur together:

1. Inference cost collapses: Models such as MiniMax M2.5 already operate at roughly 1/20th the cost of Claude Opus 4.6, making continuous or large-scale use economically trivial for many actors.
2. Behavioral constraints weaken: The most severe behaviors documented in Anthropic’s System Card were observed in earlier internal versions of Mythos during development, not in the preview model shared through Project Glasswing. Mitigating those behaviors required extensive post-training alignment and evaluation, including custom safety pipelines, interpretability work, and repeated testing. That effort was expansive, labor-intensive, and specific to Anthropic’s training process, which means it doesn't transfer with model weights. As a result, those early behaviors are best understood as a plausible preview of what similarly capable but less-aligned deployments could exhibit, not a property of the released Mythos Preview itself.

Taken together, the defender's planning window isn't "when Anthropic releases Mythos publicly." It is when open-weight models reach Mythos level cyber capability without those behavioral constraints. That clock effectively started on April 7, and it is measured in months, not years.

Rethinking patch management for the AI era

Patch Tuesday is an artifact of a different era. Monthly patching cadence was designed around human-speed vulnerability discovery, human-speed exploit development, and human-speed change control processes. Those assumptions are now a structural liability. The shift isn't as simple as "just patch faster." The landscape requires a fundamental change toward precision sniper patching and continuous threat exposure management: processes that are agile, targeted, rapid, and iterative.

As software development has embraced faster CI/CD pipelines and AI-enabled workflows, security must follow the same pattern. The security side of the house has been slower to make that shift, but the rate at which Mythos stands to accelerate patch cycles will force it.

AI-era patch management means treating vulnerability remediation the way modern software teams treat deployment: combining automated execution with real-time intelligence, verification gates, and continuous feedback loops rather than periodic batch operations.

The industry already knew this was directionally true. AI-assisted vulnerability discovery has been a topic at every major security conference and research organization for years. Mythos isn't a surprise in kind, only in magnitude and speed of arrival. The timeline compressed from "eventually" to "now." The assumptions baked into your program around SLAs, tooling, staffing, and prioritization frameworks were built for a world that no longer exists.

Verification isn't optional

Deploying a patch and walking away doesn't provide confidence in remediation without additional checks to understand whether the patch was sufficient and successful. In a world where you're patching faster and at higher volume, the risk of incomplete coverage grows through:

• Unmanaged endpoints that fall outside patch deployment scope
• Exceptions and deferrals that accumulate into permanent gaps
• Failed deployments that report as successful
• Stale gold images that re-deploy into your environment with outdated software until the next patch cycle

Knowing you've verifiably closed a vulnerability across every endpoint matters more than ever when adversaries can resurface on missed machines. Continuous Threat Exposure Management, or treating exposure reduction as iteration and not a one-time project, is the operational model that fits this environment.

An expanded definition of “secure by default"

Classically, "secure by default" meant safe shipping configuration: least privilege, hardened defaults, reduced attack surface assuming human-speed attackers.

Per Anthropic's public Glasswing materials, Mythos-related research includes findings such as a 27-year-old vulnerability in OpenBSD, a 16-year-old FFmpeg bug that survived enormous, automated fuzzing volume, and autonomous chaining of Linux kernel issues to full machine control.

If tooling at this capability class can surface decades-old issues in heavily audited codebases, then "secure by default" must extend well beyond configuration. It needs to mean that every piece of software shipping today is being actively scanned by equivalent tooling before it reaches production. For infrastructure, assume that exposed services face continuous probing at least at this capability level. Network segmentation, zero-trust architectures, and runtime isolation are no longer maturity-model aspirations—they're baseline architecture requirements.

Accessibility: Cost is temporary; capability is emergent

Near term, Mythos-class access is expensive. Glasswing-era pricing cited by Anthropic is $25/$125 per million input/output tokens versus $5/$25 for Opus 4.6—a 5x increase. Heavy continuous scanning at that price isn't trivial, but cost is a temporary barrier.

Anthropic states they did not explicitly train Mythos Preview for offensive cyber; these capabilities "emerged as a downstream consequence of general improvements in code, reasoning, and autonomy." It makes sense, when you consider the curiosity, autonomy, and resourcefulness that makes a great hacker great.

If that holds, similar surfaces will appear in every sufficiently capable model going forward, regardless of vendor intent.

Combined with compressing open-weight lag and falling inference costs, "who can afford the API" isn't the long-term gate. "Who has a fleet and a supply chain" is.

The vector inside the house: Agents, harnesses, and hard boundaries

External misuse by offensive actors gets most of the airtime with a release like Mythos. But the parallel risk is internal: approved or shadow agents with broad tool access, enterprise data, and live credentials operating inside your perimeter.

Research cataloging over 177,000 MCP (Model Context Protocol) tools reports routine agent integration across filesystems, browsers, code execution environments, databases, and production APIs as standard harness capabilities.

"Claw"-style harnesses—tight tool loops with persistent autonomy—have spread quickly; OpenClaw rose to approximately 247,000 GitHub stars in eight weeks with dozens of derivatives, with default access patterns spanning terminals, browsers, filesystems, memory retrieval, and external integrations. Broad access plus autonomy expands attack surface inward and outward simultaneously.

Harness-level rules are still code written by people. They fail; models route around them when task completion dominates. Anthropic's System Card describes an episode in which Mythos, asked to fix a bug and push a signed commit without credentials, searched supervisor state and attempted memory extraction after a user nudge—behavior characterized as goal pursuit outweighing risk assessment. That episode occurred in pre-release evaluation before additional alignment work. Anthropic calls the shipping Mythos Preview highly aligned by their measures, while noting that rare, misaligned actions can still be severe precisely because of raw capability.

Visibility inside the AI enterprise

The first requirement is knowing what is running inside the perimeter, approved and not. Most organizations lack a clear picture of local inference, AI assistants, and autonomous agents deployed across their environment. You cannot secure what you cannot see, and right now most organizations have no reliable inventory of how much AI is actually running inside their perimeter.

[Explore what AI compliance means for modern enterprises and how evolving regulations are shaping responsible AI governance]

The cybersecurity industry as a whole will need to continue investing heavily in AI visibility tooling, because the gap between what organizations think is running and what is actually running is significant and growing.

Secure deployment and real-time management of AI agents

Visibility alone isn't enough. Organizations also need a way to deploy AI agents securely and manage them centrally across their entire fleet. Behavioral training and application-level guardrails are useful—they're not sufficient guarantees against capable, goal-seeking agents.

Emerging patterns include OS-level policy for filesystem, network, and process constraints, with major security vendors including Cisco, CrowdStrike, Google Cloud, and Microsoft already collaborating on runtime policy standards for autonomous agents.

In one analysis, Claude referred to some of its safeguards in the March 2026 system map leak as “defense by vibes.” While human-readable rulesets and guidelines may become part of our standard defensive toolkit, there are still minimal engineering controls checklists:

1. Sandbox isolation at the OS/container boundary (not a system prompt instruction): Agents must run in isolated containers so that consequences are contained if agents misbehave, enforced at the infrastructure level rather than by the model's safety training.
2. Network policy on every egress path: Every outbound connection must be intercepted and evaluated against policy. An agent that cannot reach an endpoint cannot interact with it, protecting internal services from rogue agents and enterprise data from exfiltration.
3. Credentials outside the agent environment: Credentials should never be accessible within an agent's sandbox. They should be maintained by a proxy outside the agent environment and injected into outbound requests only after they have left the agent sandbox.
4. Central routing and logging for inference, tools, and network calls: All outbound requests should route through a proxy with full logging of every network request, inference call, and tool invocation, enabling efficient forensic investigation and compliance validation.

From signal to response: What this changes for defenders

The Mythos risks outlined above are real, but they're not unknowable. What remains uncertain is timing, not direction. We don't yet know the precise date when open-weight models will match Mythos on full-spectrum autonomous cyber tasks, nor do we have broad, independent replication of every Anthropic Firefox-class result across environments and stacks.

What is clear is that defenders no longer have the luxury of waiting for certainty. Exploit discovery and weaponization timelines are compressing faster than most patching and exposure management programs were designed to absorb. In that environment, reacting to headlines is less useful than pressure-testing assumptions.

The most productive question for security and IT leaders now isn't “How bad does Mythos get?” It is “Where does our current operating model fail first if exposure windows keep shrinking?”

For some organizations, the strain appears in prioritization. For others, it shows up in testing throughput, deployment constraints, or proof of closure across fragmented endpoint estates. In almost every case, the weak point isn't tooling in isolation, but the sequence by which vulnerability insight is turned into verified risk reduction.

That shift—from understanding risk to operationalizing response—is where the Mythos conversation becomes consequential. The remaining challenge is organizational rather than theoretical: whether existing vulnerability and patching assumptions still hold as discovery, prioritization, and exploitation move closer together.

Because Mythos is inevitable, patching isn't optional and must be done at speed and scale. Tanium Autonomous Patch Management transforms endpoint management and security with autonomous, integrated, and comprehensive patching.

Driven by AI and real-time endpoint intelligence, Tanium helps reduce exposure windows that Mythos-class models are built to exploit before adversaries can act on the vulnerabilities they find.

Mythos security risk FAQs

The Mythos release generated significant coverage, some of it precise and some of it not. These clarifications address the most common points of confusion.

Did the released Mythos model escape sandboxes and cover its tracks?

No, not the released model. The behavioral incidents Anthropic documents, including sandbox escape, track-covering, credential fishing via /proc/, posting confidential material, are attributed to earlier internal versions of Mythos, not the Glasswing-era Mythos Preview.

The Anthropic System Card is explicit that severe incidents of that kind involved versions that "predated" some of Anthropic's most effective training interventions (p. 54). The released model is described as still taking reckless shortcuts in lower-stakes settings but not exhibiting the same severe deception patterns. Citing those behaviors without the version qualifier is technically inaccurate.

If Mythos failed against patched systems, does that mean patching is still sufficient?

Patching remains the defender's primary leverage point, and Mythos's failure against "a properly configured sandbox with modern patches" (Anthropic System Card, p. 52) is good news buried under the headline numbers.

Mythos reads as a precision weapon against lagging hygiene and unpatched stacks. The organizational challenge is whether teams can patch, validate coverage, and refresh images fast enough when discovery and weaponization are both compressing. The answer is pace and verification.

What does it mean that standard benchmarks are "saturated"?

Anthropic has shifted evaluation focus to novel real-world security tasks, including zero-day discovery in production software, because benchmarks that measure replication of known vulnerabilities eventually stop providing useful differentiation at the frontier.

When a benchmark saturates, it doesn't mean the task is solved in any absolute sense. It means the test has reached the limits it was designed to measure. Mythos’s 100% score on Cybench indicates that this specific benchmark no longer provides meaningful separation among top-end models, a normal and recurring outcome as model capabilities improve.

The practical implication is straightforward: evaluation evolves alongside capability. As models advance, benchmarks are refined, replaced, or made more challenging so they continue to measure what matters. In this case, Anthropic’s evaluation emphasis is shifting toward harder, less replayable tasks precisely because those better reflect the kinds of real-world AI security questions practitioners care about.

Were Mythos's offensive capabilities deliberately trained?

No. Anthropic states: "We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy."

This means similar capability surfaces are likely to emerge in models with comparable scale, training regimes, and architectural characteristics to frontier LLMs like Mythos. While companies don't disclose full details of those architectures, the trend suggests that capability diffusion is driven less by policy choices than by the underlying dynamics of general purpose‑ model scaling.

Additional resources

• Watch this on-demand demo to see how Tanium Autonomous Patch Management helps organizations close the vulnerability exposure gap continuously—addressing AI‑driven threats at the speed and scale today’s environments require.

Anthropic

• Claude Mythos Preview System Card
• Assessing Claude Mythos Preview’s cybersecurity capabilities
• Project Glasswing
• Introducing Claude Opus 4.5
• Introducing Claude Opus 4.6

Model capability and evaluation research

• METR
  • Time Horizon 1.1
  • Measuring AI Ability to Complete Long Tasks
  • Task‑Completion Time Horizons dashboard
• Epoch AI
  • Open‑weight models lag state‑of‑the‑art by ~3 months on average

Open‑weight models

• MiniMax
  • MiniMax M2.5: Built for Real‑World Productivity
• Moonshot AI
  • Kimi K2: Open Agentic Intelligence
• Hugging Face
  • Kimi‑K2.5 model card

Industry analysis and reporting

• VentureBeat
  • MiniMax M2.5 near state‑of‑the‑art performance at ~1/20th the cost
• CyberScoop
  • Security leaders say the next two years are going to be ‘insane’
• Techbriefly
  • Z.ai launches GLM‑5.1 model, surpassing competitors in benchmarks
• HPCwire
  • China’s Moonshot AI releases trillion‑parameter Kimi K2

Foundational model publications

• OpenAI
  • GPT‑4 Technical Report
  • Introducing GPT‑5.2
• Meta
  • Introducing Llama 3.1