Anthropic announced Claude Mythos Preview on April 7, 2026. It’s officially the most capable model they’ve ever built, surpassing Opus 4.6 across every benchmark. Access is restricted to 12 core partners — Amazon, Apple, Broadcom, Cisco, CrowdStrike, Linux Foundation, Microsoft, Palo Alto Networks, and a handful of others. Anthropic says they don’t plan general release. Not next quarter. Not ever.

If you want a full picture of what Claude can do beyond the cutting edge research models, our Claude AI complete guide covers the production models, pricing, and real-world performance.

The reason? Mythos Preview can autonomously find and exploit software vulnerabilities at a level that matches or exceeds all but the most skilled human security researchers. It’s the first frontier AI model where the lab openly admits the capabilities are too dangerous to ship to the public.

The Capability Leap: 181 Working Exploits vs 2

On Firefox exploit development, Mythos Preview achieved 181 working exploits compared to only 2 for Opus 4.6 — a 90.5x improvement. Not “better at identifying potential issues.” Not “suggesting security improvements.” Writing actual, working exploits that bypass sandboxes and achieve code execution.

Mythos hit register control — a critical step in exploitation where you manipulate CPU registers to redirect execution flow — 29 times on Firefox vulnerabilities. Opus 4.6? Near zero. On the OSS-Fuzz corpus benchmarks, Mythos produced 10 tier-5 crashes, which means full control flow hijack. Opus 4.6 had none.

Benchmark	Claude Mythos Preview	Claude Opus 4.6	Gap
Firefox working exploits	181	2	90.5x
SWE-bench Pro	77.8%	53.4%	+24 points
SWE-bench Verified	93.9%	80.8%	+13 points
Register control instances	29	~0	—
Tier-5 crashes	10	0	—
GPQA Diamond (reasoning)	94.6%	91.3%	+3.3 points

The SWE-bench Pro gap matters because it’s a coding benchmark designed to be difficult — real-world software engineering problems pulled from GitHub issues. A 24-point jump there translates to substantially better code reasoning, which is exactly what you need to trace data flows through complex codebases and spot exploitable conditions.

What Mythos Can Do: Autonomous Exploit Development That Should Scare You

Mythos Preview found zero-day vulnerabilities in every major operating system and web browser, discovering thousands of high-severity bugs in just weeks.

It wrote a 4-vulnerability browser exploit chain with JIT heap spray that escaped both the renderer sandbox and the OS sandbox. No human intervention. It achieved local privilege escalation on Linux by exploiting race conditions and KASLR-bypass techniques — again, autonomously. On FreeBSD, it developed a remote code execution exploit for an NFS server vulnerability with a 20-gadget ROP chain in approximately 4 hours.

ROP chains — return-oriented programming — are notoriously tedious. You’re chaining together snippets of existing code (“gadgets”) to build arbitrary behavior without injecting new code. Humans spend days or weeks on complex chains. Mythos finished in under a workday.

It discovered a 27-year-old vulnerability in OpenBSD that’s now been patched. In March 2026, it found a blind SQL injection in Ghost (the publishing platform with 50,000 GitHub stars) that allowed unauthenticated admin database compromise. Bugs that evaded decades of expert review and open-source scrutiny.

Our red team got Project Glasswing access in March. We pointed Mythos Preview at our API gateway codebase. Within 6 hours of compute time, it wrote a proof-of-concept exploit for a race condition in our request rate limiter that could’ve granted unlimited API calls. The vulnerability was introduced in a refactor 14 months prior. Three senior engineers had reviewed that PR. None caught it. We now run Mythos scans on every major release branch before merge.

Engineers with no security training could wake up to working exploits after overnight runs. The barrier to entry for sophisticated exploitation just collapsed.

Here’s the other thing: Mythos Preview wasn’t specifically trained for security. These capabilities emerged from general improvements in code understanding, reasoning, and autonomy. Anthropic didn’t set out to build an exploit generator. They built a better reasoner, and exploitation turned out to be a downstream capability.

Why Anthropic Won’t Release It: The Dual-Use Dilemma

The concern is simple: put this in the hands of threat actors and they’ll find and exploit vulnerabilities faster than defenders can patch them. CrowdStrike, a founding Project Glasswing partner, says the model compresses the window between disclosure and working attacks from weeks to hours.

Most software vulnerabilities rely on friction as part of their defense. Exploitation is tedious. You need to craft payloads, calculate offsets, test reliability, chain primitives. Human attackers give up or move to easier targets. But a model that grinds through exploitation steps without fatigue doesn’t care about friction-based mitigations. Mitigations whose security value comes from making exploitation tedious rather than impossible become considerably weaker against model-assisted adversaries.

ASLR (address space layout randomization) makes exploitation harder by randomizing memory layouts. DEP (data execution prevention) blocks code injection into certain memory regions. Stack canaries detect buffer overflows. None of these are perfect barriers — they’re speed bumps. Against a human, speed bumps matter. Against a model running 24/7 that can try thousands of variations without fatigue? Speed bumps don’t buy you much time.

Anthropic’s official position: “Claude Mythos Preview represents an unreleased frontier model that reveals AI has reached a capability level where it can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” That’s not marketing language. That’s a public acknowledgment that the technology is dual-use in the most literal sense.

Can limited release truly prevent offensive use? Nation-state actors and well-funded adversaries will develop similar capabilities independently if they haven’t already. Restricting Mythos buys time for defenders to harden systems, but it doesn’t stop the broader trend. Anthropic knows this. They’re explicit about it: “Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors committed to deploying them safely.”

Project Glasswing: Giving Defenders the Advantage (For Now)

Project Glasswing is named after the Greta oto butterfly — the glasswing, which has transparent wings. The metaphor: transparency in vulnerability discovery and responsible disclosure. Anthropic is committing up to $100M in usage credits for Mythos Preview and $4M in direct donations to open-source security organizations.

The 12 core partners — cloud providers, security vendors, infrastructure maintainers — use Mythos to scan both their own systems and critical open-source projects. Find vulnerabilities, patch them, disclose responsibly. The goal is to give defenders a head start before adversaries get equivalent capabilities.

The structure mirrors how Google’s OSS-Fuzz transformed automated fuzzing. Make a powerful security tool freely available to open-source projects, let them harden their code before attackers find the bugs. OSS-Fuzz has found over 10,000 vulnerabilities since 2016. Glasswing is aiming for that kind of scale, but with a model that reasons about code instead of just throwing random inputs at parsers.

For context: Claude Opus 4.6 — the publicly available model — has already found over 500 high-severity vulnerabilities in production open-source codebases. Many had gone undetected for decades. Mythos is well beyond that.

We ran Opus 4.6 Code Security against our legacy authentication service (220K LOC, in production since 2019) overnight. It flagged 8 issues. Two were false positives. Six were real — including a timing side-channel in our password reset flow that would’ve let an attacker enumerate valid emails. Our security audit 18 months ago missed it. We patched all six within 72 hours.

That’s the publicly available model. Mythos is substantially more capable. If your organization builds or maintains critical software and you qualify for Glasswing access, apply. Scan your codebases now, before someone else does it for you.

How Mythos Compares to GPT-5 and Gemini Ultra

There are no public security-focused benchmarks available for GPT-5 or Gemini Ultra at this capability level. OpenAI and Google haven’t announced comparable autonomous exploit development capabilities or defenders-first access programs.

On general coding benchmarks, GPT-5.4 scores 71.7% on SWE-bench Verified, and Gemini sits around 63.8%. Mythos Preview is at 93.9%. That’s a substantial gap, though those models weren’t designed with the same focus on autonomous reasoning over long-horizon tasks.

For a broader breakdown of how frontier models compare across production workloads, see our overview of the best AI models in 2026. If you’re specifically evaluating Claude versus GPT for your use case, we’ve got a how Claude stacks up against ChatGPT that covers cost, context windows, and task-specific performance.

The key differentiator here isn’t raw benchmark performance. It’s that Anthropic is the first frontier lab to openly acknowledge building capabilities “too dangerous to release” and to follow through with a defenders-first access model. That’s a real policy shift. OpenAI and Google have taken different approaches to enterprise security — GPT-5 offers opt-in training and zero-retention modes; Gemini uses Google Cloud infrastructure with data governance controls — but neither has announced a restricted-access model specifically due to dual-use cybersecurity concerns.

Will they follow suit with their own vulnerability-hunting models? Or will they argue that broader access accelerates defensive research faster than it enables attackers?

What This Means for Security Teams

AI-accelerated vulnerability discovery is now reality, not speculation. Your threat model should assume attackers will gain similar capabilities within 12-18 months if they don’t have them already.

Three priorities:

Faster patch cycles. The window between disclosure and exploitation is compressing. If you’re on a monthly patch cadence for anything touching trust boundaries, that’s too slow. Weekly for critical services. Daily if you can manage it.

Defense-in-depth beyond friction-based mitigations. ASLR, stack canaries, DEP: still necessary, but don’t rely on them as your primary defense against exploitation. Models don’t get tired. They don’t give up because bypassing a mitigation is tedious. Plan for attackers who can grind through dozens of exploit variants overnight.

Assume breach posture. If an attacker with Mythos-class capabilities targets your infrastructure, assume they’ll find something. Segment your networks. Limit lateral movement. Monitor for post-exploitation behavior, not just initial compromise.

The Firefox exploit stat — 181 vs 2 — isn’t just a benchmark number. Our red team spent an average of 6-8 weeks developing a working browser exploit for client assessments. If threat actors get Mythos-class capabilities, that timeline compresses to days or hours. We’ve already revised our threat model assumptions and accelerated patch SLAs for anything touching sandboxes or privilege boundaries.

If your organization qualifies for Project Glasswing access — if you build or maintain critical software — apply to scan your codebases. Even without Mythos access, Claude Opus 4.6’s publicly available Code Security capabilities found 500+ vulnerabilities in production systems. You can start there.

Expect AI-discovered vulnerabilities to become a significant portion of CVEs within the next 12-18 months. An AI security startup found all 12 zero-day vulnerabilities in OpenSSL’s January 2026 security patch, and AI systems accounted for 13 of 14 total OpenSSL CVEs in 2025. That trend isn’t reversing.

The Controversy: Pentagon Dispute and Responsible AI Tensions

The Mythos announcement comes amid a legal battle between Anthropic and the Trump administration. In February 2026, the Pentagon designated Anthropic a supply chain risk after the company refused to provide unrestricted access to its technology for potential use in mass surveillance of US citizens or autonomous weapons targeting.

Anthropic’s two red lines: no mass surveillance of US citizens, no autonomous weapons targeting. The Pentagon’s position: they want AI for “all lawful purposes” and can’t allow a private company to dictate how they use tools in a national security emergency.

A federal judge temporarily blocked the supply chain designation in March 2026. The Trump administration has appealed. Supply chain risk designations are typically reserved for foreign adversaries — Huawei, ZTE — not US-based AI labs. The designation impacts how defense contractors and federal agencies can use Claude.

The Mythos restricted release reinforces Anthropic’s stance on responsible AI, potentially influencing the Pentagon dispute. If the government’s argument is that Anthropic’s safety restrictions hamper national security, Anthropic can point to Mythos and say: we’re giving the DoD and critical infrastructure partners access to our most powerful model specifically for defensive cybersecurity. We’re just not giving you unrestricted offensive capabilities or mass surveillance tools.

It’s the sharpest collision yet between AI safety principles and national security imperatives. Other labs are watching closely. If Anthropic wins, it sets a precedent that AI companies can impose use restrictions on government customers. If the Pentagon wins, it signals that national security takes precedence over corporate AI safety policies.

What’s Next: The Arms Race Nobody Wanted

The capability is out of the bag. Even if Anthropic restricts Mythos, other labs and nation-states will develop similar models. China’s DeepSeek already demonstrated competitive reasoning capabilities at a fraction of the training cost. It’s reasonable to assume that major intelligence services are investing heavily in offensive AI capabilities if they haven’t already built them.

The question isn’t whether this happens — it’s whether defenders can use AI-powered vulnerability detection fast enough to stay ahead of AI-powered exploitation. Right now, defenders have a head start through initiatives like Glasswing. That advantage is temporary.

Over the next 12 months, watch for other frontier labs announcing security-focused models or restricted-access programs. Watch for nation-state investment in offensive AI becoming more visible — through leaks or policy announcements. And watch for policy frameworks on dual-use AI from NIST, CISA, or international bodies. None of these will move fast enough, but they’re the leading indicators of where this goes.

Anthropic says they’ll eventually release Mythos-class capabilities publicly, once they’ve built safeguards to detect and block dangerous outputs. That’s the optimistic path: build the safety infrastructure, then release the capability. The pessimistic path is that adversaries develop equivalent models faster than safety research can keep up, and we end up in an exploit-discovery arms race where defenders are perpetually behind.

The industry needs standards for pre-release security evaluations, responsible disclosure frameworks for AI-discovered vulnerabilities, and international cooperation on dual-use AI governance. None of that exists yet in any real sense. We’re making this up as we go.

Practitioners should prepare for accelerated CVE disclosure timelines, AI-assisted threat hunting becoming standard practice, and a rethinking of the vulnerability lifecycle. The assumption that “hard to exploit” buys you weeks or months to patch is no longer safe. If a model can turn a difficult race condition into a working exploit in hours, your remediation timelines need to match that speed.

Frequently Asked Questions

What is Claude Mythos Preview?

Claude Mythos Preview is Anthropic’s most powerful AI model, surpassing Opus 4.6 across all benchmarks. It can autonomously find and exploit software vulnerabilities at a level matching the most skilled human security researchers. Access is restricted to approximately 40 organizations, primarily security vendors and infrastructure maintainers.

Why isn’t Claude Mythos publicly available?

Anthropic explicitly states they don’t plan general release due to dual-use cybersecurity capabilities. The model can autonomously develop working exploits for zero-day vulnerabilities, compressing the window between discovery and exploitation from weeks to hours. Public release could enable threat actors to weaponize these capabilities faster than defenders can respond.

How does Claude Mythos compare to Claude Opus 4.6?

On Firefox exploit development, Mythos achieved 181 working exploits compared to 2 for Opus 4.6 — a 90.5x improvement. On SWE-bench Pro, Mythos scores 77.8% vs 53.4% for Opus (24-point gap). Mythos also achieved 29 instances of register control and 10 tier-5 crashes on security benchmarks, compared to near-zero for Opus.

What is Project Glasswing?

Project Glasswing is Anthropic’s initiative to give defenders a head start in AI-driven cybersecurity. Named after the glasswing butterfly, it provides restricted Mythos Preview access to security partners along with up to $100M in usage credits and $4M in direct donations to open-source security organizations. Partners use Mythos to scan and secure both their own systems and critical open-source projects before attackers can exploit vulnerabilities.

Can AI really find zero-day vulnerabilities autonomously?

Yes. Mythos Preview found zero-days in every major operating system and web browser, discovering thousands of high-severity vulnerabilities in weeks. It developed a FreeBSD NFS server RCE exploit with a 20-gadget ROP chain in approximately 4 hours, achieved local privilege escalation on Linux using race conditions and KASLR-bypass techniques, and discovered a 27-year-old vulnerability in OpenBSD. These capabilities emerged from general improvements in code reasoning, not security-specific training.

Who has access to Claude Mythos Preview?

Access is limited to 12 core partners (Amazon, Apple, Broadcom, Cisco, CrowdStrike, Linux Foundation, Microsoft, Palo Alto Networks) and approximately 40 total organizations focused on securing critical infrastructure and open-source software. Anthropic is accepting applications from organizations that build or maintain critical software systems.

How does Claude Mythos compare to GPT-5 and Gemini Ultra?

No public security-focused benchmarks exist for GPT-5 or Gemini Ultra at this capability level. On general coding benchmarks, GPT-5.4 scores 71.7% on SWE-bench Verified and Gemini scores around 63.8%, compared to Mythos Preview’s 93.9%. Neither OpenAI nor Google have announced comparable autonomous exploit development capabilities or defenders-first access programs. Anthropic is the first frontier lab to openly restrict a model due to dual-use cybersecurity concerns.

What is the Anthropic Pentagon controversy about?

In February 2026, the Pentagon designated Anthropic a supply chain risk after the company refused unrestricted access for mass surveillance of US citizens or autonomous weapons targeting. A federal judge temporarily blocked this designation in March 2026. The dispute highlights tensions between AI safety principles and national security imperatives, with the Trump administration arguing that the government needs “all lawful purposes” access and Anthropic maintaining red lines around surveillance and autonomous weapons.

For the regulatory fallout and what security teams should do in response, see our follow-up: Claude Mythos triggers global regulatory alarm.