Claude Mythos: Situation Assessment for Security Teams

7 min. read time

Anthropic has built an AI model that identifies vulnerabilities faster and deeper than most security teams. Claude Mythos uncovered a 27-year-old bug in OpenBSD, a 16-year-old flaw in FFmpeg, and multiple privilege escalation paths in the Linux kernel. Instead of releasing the model publicly, Anthropic is distributing it through Project Glasswing to over 40 organizations-including AWS, Microsoft, CrowdStrike, and the Linux Foundation. Here is the situation assessment.

Key Takeaways

• Claude Mythos scores 83.1 percent on the CyberGym benchmark for vulnerability detection – Opus 4.6 reaches 66.6 percent (Anthropic, April 2026).
• The model uncovered critical zero-day vulnerabilities in OpenBSD (27 years old, remote crash), FFmpeg (16 years old, missed in 5 million tests), and the Linux kernel (privilege escalation via DRR scheduler).
• Mythos chains individual vulnerabilities into complete attack paths-a capability previously reserved for elite penetration testers.
• Project Glasswing grants controlled access to over 40 organizations. Patches are already being rolled out.
• All findings will be disclosed within 90 days. 4 million US dollars are allocated to open-source security projects.

The Findings in Detail

Three findings reveal the scale.

A vulnerability existed for 27 years within the SACK (Selective Acknowledgment) implementation of the TCP stack-a mechanism for handling packet loss. It enables a remote Denial of Service attack against any OpenBSD server. OpenBSD is regarded as one of the most secure operating systems. Its code is regularly manually audited by experienced security researchers. Nevertheless, the bug remained undetected.

FFmpeg-the multimedia library that provides video and audio processing on practically every platform-contained a bug in the H.264 codec. 16 years old. 5 million automated tests had traversed the affected code section without triggering the vulnerability. FFmpeg confirmed and patched the bug following the report by Anthropic.

Within the Linux kernel, Mythos identified several privilege escalation paths, including a vulnerability in the DRR (Deficit Round Robin) scheduler-an algorithm for distributing network bandwidth. An unprivileged user could obtain full root privileges through this pathway.

Why the Model Isn’t a Security AI – And Still Better Than Most

Anthropic did not train Mythos specifically for security. The model was optimized as a coding model. On SWE-bench Verified, it achieves 93.9 percent. Opus 4.6 scores 80.8 percent.

The security capabilities are an emergent property. Anyone who understands code at this level inherently knows where code is vulnerable. The model finds not only individual vulnerabilities. It chains several smaller bugs into complete attack paths-three, four, five vulnerabilities combined into a functioning exploit. This is the workflow of an experienced red-team operator, not a scanner.

On the CyberGym benchmark, Mythos reaches 83.1 percent. Opus scores 66.6 percent. The gap is not incremental. It is a generational leap.

Project Glasswing: Controlled Distribution

Anthropic has opted against a public release. Instead, Mythos operates under the codename Glasswing within a controlled environment.

The partner list includes: AWS, Apple, Google, Microsoft, NVIDIA, Cisco, CrowdStrike, JPMorgan Chase, Palo Alto Networks, Broadcom, the Linux Foundation, and over 30 additional organizations.

When a tool identifies vulnerabilities in the infrastructure powering the internet, the operators of that infrastructure must receive access first-not the general public, and certainly not potential attackers.

Three concrete commitments: All findings will be shared publicly within 90 days. $100 million in usage credits are available to partners. $4 million goes directly to open-source security groups. Patches are already rolling out. FFmpeg has confirmed and fixed the 16-year-old bug. The OpenBSD and Linux kernel fixes are currently being deployed.

What This Means for Security Teams

The Consequences Across Three Time Horizons.

Short-Term: Over the Coming Weeks, deploy regular updates for all affected systems. The Glasswing patches will arrive via the standard update channels of cloud providers and operating system distributions. Those with automatic updates enabled are largely protected.

Mid-Term: Within the Next 3 to 12 Months, the benchmark for vulnerability assessments is shifting. When an AI identifies bugs that 5 million automated tests and decades of manual audits overlooked, classic fuzzing is no longer sufficient as a standalone testing method. Security teams should evaluate AI-driven code analysis within their tool stacks.

Long-Term: Each successive generation of coding models will develop comparable security capabilities. The ability to uncover complex logical vulnerabilities and chain them into exploits will become a standard feature of frontier models. This shifts the balance of power: defenders gain access to tools previously reserved for elite attackers.

The Uncomfortable Truth: The same technology will also be accessible to attackers once comparable open-source models emerge. The head start Glasswing gives defenders is time-limited. The 90-day disclosure deadline-a common industry standard-ensures patches are deployed before technical details become public.

Situation Assessment

Anthropic has set a precedent. An AI laboratory has developed a model too powerful for an uncontrolled release, opting for a defender-first approach rather than either locking it away entirely or making it public.

Whether this precedent stands depends on whether other labs follow suit. OpenAI, Google DeepMind, and Meta are likewise training next-generation coding models. If coding proficiency automatically translates into security expertise, every frontier model will become a potential tool for both attack and defense.

The pertinent question is not whether AI-driven vulnerability detection is arriving. It is already here. The real question is whether your organization can patch quickly enough when the next wave of AI-discovered zero-day vulnerabilities emerges.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.