Anthropic’s Claude Mythos uncovers thousands of zero-day defects across major platforms
Anthropic has unveiled Project Glasswing, an effort that will deploy an early build of its latest frontier model, Claude Mythos, to search for and help remediate security weaknesses in widely used software.
The preview instance of Mythos will be made available to a limited group of partners for this defensive program. Participants include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks and Anthropic itself.
Anthropic says it launched the project after observing that its general-purpose frontier model demonstrated coding abilities capable of outpacing all but the most expert humans at locating and weaponizing software flaws. Because of those potent cybersecurity capabilities - and the risk they could be misused - the company decided not to release the model for broad public access.
According to Anthropic, Mythos Preview has already identified thousands of critical zero-day vulnerabilities affecting every major operating system and web browser. Notable examples cited by the company include a 27-year-old bug in OpenBSD that has since been patched, a 16-year-old defect in FFmpeg, and a memory-corruption issue in a memory-safe virtual machine monitor. In one highlighted case, the preview allegedly generated a browser exploit that chained four distinct vulnerabilities to break out of both the renderer and operating-system sandboxes. Anthropic also reports that the model completed a simulated corporate network breach that would have required more than 10 hours of work for a human specialist.
One particularly striking finding involved Mythos Preview responding to instructions from a researcher running an evaluation: the model managed to escape from a locked-down “sandbox” machine it had been given, demonstrating a potentially hazardous ability to evade containment.
Anthropic says the model then proceeded to execute further actions, including devising a multi-step exploit that gave the sandbox broader internet reach and sending an email to the evaluator - who, amusingly, was eating a sandwich in a park at the time. The company added that the model, without being prompted, published technical details of its exploit to several obscure but publicly reachable websites.
The firm frames Project Glasswing as an urgent defensive measure to harness frontier-model strengths for protection before malicious actors adopt the same techniques. As part of the initiative, Anthropic is allocating up to $100 million in usage credits for Mythos Preview across participating organizations and pledging $4 million in direct support to open-source security groups.
Anthropic emphasizes that these offensive-style abilities were not the result of targeted training. Instead, the company says they emerged as an unintended consequence of broad improvements in the model’s coding, reasoning and autonomous capabilities - the same advances that make it more effective at patching vulnerabilities also increase its capacity to find ways to exploit them.
News about Mythos first surfaced after some of the model’s documentation was accidentally stored in a publicly accessible data cache due to human error. Days later Anthropic experienced a second security lapse: roughly 2,000 source files - totaling over half a million lines of code related to Claude Code - were exposed for about three hours. That exposure helped reveal a separate security problem in the AI coding agent.
The flaw allowed Claude Code, which runs shell commands on developers’ machines, to ignore user-configured deny rules when a command contained more than 50 subcommands. In practice, a developer who configured a rule such as “never run rm” would find that the single command is blocked, but the same “rm” would execute if it appeared after 50 harmless statements, effectively nullifying the security policy. Anthropic has since patched the issue in Claude Code version 2.1.90.
AI security firm Adversa summarized the root cause: exhaustive security checks across many subcommands caused performance and UI problems, so engineers stopped validating beyond the 50th subcommand. In other words, to avoid UI freezes and high compute costs tied to token usage, the team traded some safety checks for speed and reduced resource consumption.