On March 26, 2026, a configuration error in Anthropic’s content management system exposed an unpublished draft blog post. It contained a single sentence that sent chills through the cybersecurity industry: Claude Mythos was “the most powerful AI model Anthropic has ever developed.”
Eleven days later, Anthropic did something unprecedented in the AI industry. They published a 244-page System Card detailing exactly how powerful Mythos is—and then told the world they would not release it.
Not because it wasn’t ready. Not because it was still in testing. Because it was too dangerous.
This is the story of how an AI model was leaked, shelved, and then weaponized for good—and what it means for the future of cybersecurity, personal privacy, and the companies that profit from both sides of the digital arms race.
The Leak: How Mythos Was Exposed
Anthropic’s internal codename for Mythos was “Capybara.” It sat above Opus in an entirely new tier—not a incremental upgrade, but a generational leap. Nobody outside Anthropic was supposed to know it existed.
Then someone misconfigured a CMS permission. A draft blog post went live briefly, and Fortune broke the story. The cat was out of the bag.
This wasn’t a hack. It wasn’t a whistle-blower. It was a mundane administrative error—the same kind that exposes corporate secrets every day. And it raises an uncomfortable question: if a company as security-conscious as Anthropic can accidentally leak the existence of their most powerful model, how secure is your data?
In the cyber era, the boundary between “internal” and “public” is thinner than we’d like to admit. One wrong click, one misconfigured permission, and secrets become headlines. This is true for AI labs, and it’s true for the hospital storing your medical records, the bank holding your transaction history, and the messaging app carrying your private conversations.
The Shelving: Why Anthropic Chose Not to Ship
Here’s what Mythos can do, according to Anthropic’s own System Card:
- CyberGym benchmark: 83.1% (vs. Opus 4.6 at 66.6%)
- Cybench CTF challenges: 100% success rate across all 35 challenges—every problem, every round, full marks. The benchmark was effectively “solved.”
- Firefox exploit development: 181 successful exploits vs. Opus’s 2. A 90x difference.
But benchmarks are abstract. The real-world results were more sobering:
- A 27-year-old vulnerability in OpenBSD—one of the most security-hardened operating systems ever built. Mythos found it. No human had, in nearly three decades.
- A 16-year-old bug in FFmpeg—the video codec library used by countless applications. The problematic line of code had been hit by automated testing tools over 5 million times without detection.
- A complete privilege escalation chain in the Linux kernel—stitching multiple vulnerabilities together to go from ordinary user access to full machine control, entirely autonomously.
Anthropic’s own security researcher Nicholas Carlini put it plainly: “In the past few weeks, I’ve found more bugs than in my entire career.”
After three days of intense internal deliberation, Anthropic made the call: Mythos would not be released to the public. The model was too effective at offensive cyber operations. In the wrong hands, it could automate the kind of attacks that currently require elite nation-state hackers.
The Pivot: Project Glasswing
But Anthropic didn’t lock Mythos in a vault either. Instead, they launched Project Glasswing—a “defense-only” deployment strategy that gives Mythos to the people who need it most: the defenders.
The first 12 partners read like a who’s who of global infrastructure: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Over 40 additional organizations responsible for critical software infrastructure also received access.
The rules are strict:
- Mythos can only be used to find vulnerabilities in your own systems or open-source projects you maintain
- All discovered vulnerabilities must go through coordinated disclosure
- Anthropic retains oversight of how the model is deployed
Anthropic committed up to $100 million in usage credits, plus $4 million in direct donations to open-source security organizations like the Linux Foundation’s Alpha-Omega and OpenSSF.
As Jim Zemlin, CEO of the Linux Foundation, noted: “In the past, deep security expertise was a luxury reserved for large teams. Open-source maintainers—whose software underpins most of the world’s critical infrastructure—have been fighting security battles alone.” Project Glasswing gives them the same caliber of tool that the biggest companies have.
The Dual-Use Dilemma: Tools Don’t Choose Sides
Here’s the uncomfortable truth at the center of this story: Mythos is the same model whether it’s finding a bug or exploiting it.
The capability is neutral. The intent is not.
This is the dual-use problem, and it’s not new. Nuclear technology powers cities and levels them. Cryptography protects dissidents and shields criminals. The internet spreads knowledge and misinformation. Every powerful tool in human history has been a double-edged sword.
What’s different now is scale and accessibility. A single AI model can do in minutes what used to require a team of elite security researchers working for months. And as Anthropic themselves noted: “Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely.”
Mythos is shelved today. But the next Mythos—from another lab, another country, another actor—might not be. The question isn’t whether this capability will exist in the wild. It’s whether the defenders will be ready when it does.
Personal Privacy in the Crossfire
For most people, the Mythos story feels distant—something that concerns tech giants and nation-states. But the implications hit much closer to home.
When AI can autonomously find and chain vulnerabilities in the software that runs hospitals, banks, power grids, and messaging apps, your personal data is downstream of every unpatched system. A 27-year-old bug in OpenBSD means 27 years of potential exposure. A flaw in FFmpeg—used by video apps, social media platforms, and conferencing tools—means your video calls, your shared media, your recorded memories could all be compromised through the same vector.
The old assumption was: “If a bug existed for 27 years and nobody found it, it probably won’t be found now.” AI invalidates that assumption entirely. Every legacy system, every forgotten codebase, every “it works, don’t touch it” deployment is now a potential target—not for a human who might get lucky, but for a machine that will systematically probe every edge case.
Your privacy depends on the security of systems you didn’t build, don’t control, and can’t audit. That was always true. What’s changed is the speed and scale at which those systems can be compromised.
The Commercial Calculus
There’s also a business angle that’s worth examining critically.
Anthropic’s decision to shelve Mythos cost them significant short-term revenue. This is a model that could command premium pricing. Instead, they’re giving away $100 million in usage credits. Why?
Three reasons, and they’re worth understanding because they reveal how “doing the right thing” and “commercial self-interest” can align:
First, narrative control. Anthropic was founded on the premise of “safe AI.” Shelving their most powerful model because it’s too dangerous is the most compelling brand validation imaginable. In the lead-up to a potential IPO, this story is worth far more than a few months of Mythos subscription revenue.
Second, deep partnerships. Project Glasswing isn’t a standard vendor relationship. It’s “we’ll let our strongest model scan your most critical systems.” The trust this builds with Apple, Microsoft, Google, and JPMorgan Chase creates commercial bonds that outlast any contract.
Third, regulatory positioning. When governments inevitably regulate offensive AI capabilities, Anthropic can point to Project Glasswing and say: “We already built the framework. We already showed restraint. We already gave defenders the advantage.” That’s not altruism—it’s strategic foresight.
The lesson for every company: sometimes the most profitable move is the one you don’t make. Restraint, when visible and verifiable, can be a competitive advantage.
What This Means for You
You’re not running a Fortune 500 company or guarding national infrastructure. But you are living in a world where:
- Your personal data lives in dozens of cloud services, each running millions of lines of code you’ll never see
- The apps on your phone contain open-source libraries maintained by volunteers who just got a powerful new tool—and so did the people targeting them
- The window between “vulnerability discovered” and “vulnerability exploited” has collapsed from months to minutes, as CrowdStrike’s CTO warned
So what can you actually do?
- Update relentlessly. Every unpatched system is a liability. Turn on automatic updates and leave them on.
- Assume breach. Use unique passwords, enable two-factor authentication, and treat every online account as potentially compromised.
- Support open source. The maintainers of critical infrastructure often work for free. Project Glasswing helps them, but so does community funding, bug bounties, and simply saying thanks.
- Pay attention to who chooses restraint. When a company has the power to release something dangerous and chooses not to, that tells you something about their values—and their long-term thinking.
The Mountaineer’s Paradox
Anthropic’s System Card contains a line worth reading three times:
“Claude Mythos Preview is the best-aligned model we have ever released across nearly every dimension we can measure… Even so, we believe it may pose the greatest alignment-related risk of any model we have released.”
They use a mountaineering analogy: a highly skilled guide can lead clients into greater danger than a novice—not because the guide is more careless, but because their skill allows them to reach places where the consequences of a mistake are more severe.
This is the paradox of every powerful tool. The better it works, the more damage it can do when something goes wrong. The question isn’t whether to build powerful tools. It’s whether we have the wisdom to decide when not to use them—and the courage to say so publicly.
Anthropic chose to stop at the ridge. They could have summited. They chose not to.
In a world racing to deploy every capability as fast as possible, that choice matters more than the model itself.
What do you think—was Anthropic right to shelve Mythos? Should AI companies be forced to disclose dangerous capabilities, or does that just help adversaries? The conversation matters.
#cybersecurity #AIethics #ClaudeMythos #ProjectGlasswing #privacy #dualuse
