Anthropic's Mythos AI model raises cybersecurity concerns
Anthropic has restricted its Mythos AI cybersecurity model to select organizations through Project Glasswing, citing unprecedented security risks, while discussing the system with U.S. and UK government authorities. Researchers demonstrated the model could autonomously exploit vulnerabilities, raising concerns about dual-use potential despite its defensive capabilities.
What happened
Anthropic has restricted distribution of its Mythos AI model to a limited set of organizations through Project Glasswing, launched in early April 2026, citing unprecedented cybersecurity risks. The model is available to founding partners including Amazon Web Services, Apple, Google, JPMorgan Chase, Microsoft, and Palo Alto Networks, plus over 40 additional organizations managing critical software.
During testing, Mythos identified thousands of previously unknown zero-day vulnerabilities, including a flaw hidden for 27 years in OpenBSD and a bug present for 16 years in FFmpeg. Anthropic is in discussions with the U.S. government about the model, stating it is too powerful for public release.
Reported impact
Research by Anthropic demonstrated that AI agents could autonomously exploit smart contract vulnerabilities, generating millions of dollars in simulated stolen funds. The UK AI Security Institute warned that Mythos represents a 'leap in level' compared to previous models in terms of cybersecurity threat.
The U.S. Treasury Secretary convened a meeting with senior U.S. banking executives to discuss Mythos, and British financial regulators are discussing potential risks. Anthropic previously failed negotiations with the U.S. Department of Defense over how its AI models could be used, resulting in the company being classified as a supply chain risk.
Index analysis
Mythos was developed as a defensive cybersecurity tool with capabilities to identify vulnerabilities at scale. The model's ability to autonomously discover and potentially exploit security flaws presents dual-use concerns, balancing its defensive utility against potential misuse risks.
Governance controls
Anthropic has committed $100 million in compute resource credits and $4 million to open-source security groups as part of Project Glasswing. The company is limiting distribution to pre-selected organizations and plans to integrate Mythos capabilities into future Claude versions at commercial pricing ($25 per million input tokens and $125 per million output tokens).
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.