← Back to articlesFlash
Alexandre3 min read
Claude Mythos: Anthropic's AI that finds 16-year-old security vulnerabilities
Anthropic just unveiled Claude Mythos Preview, a cybersecurity-focused AI model that found zero-days at scale — including a 16-year-old FFmpeg bug and a critical OpenBSD vulnerability. Access restricted to 40+ tech companies via Project Glasswing.
Alexandre3 min read
Official announcement — April 7, 2026Click to enlarge
Anthropic unveiled Claude Mythos Preview tonight — a model built for one specific purpose: finding security vulnerabilities in software. First test results: thousands of unknown vulnerabilities, some of which had been sitting undetected for over 16 years in code used everywhere.
"Over 99% of the vulnerabilities we've found have not yet been patched."
— Anthropic research team
That figure alone explains why the announcement is quiet. No press conference, no public release.
Two concrete examples that should concern everyone
OpenBSD and TCP connections
Mythos Preview identified a vulnerability in OpenBSD's SACK implementation — the protocol handling TCP retransmissions. The flaw involves a signed integer overflow on 32-bit sequence numbers, combined with a pointer corruption in a linked list.
In plain terms: any server running OpenBSD can be remotely and repeatedly crashed by an attacker who knows what to send.
FFmpeg and the 16-year-old bug
FFmpeg is the video processing library that virtually every service handling video relies on — YouTube, Netflix, Twitch, and hundreds of others.
Mythos found a vulnerability in the H.264 codec. The bug: a slice counter can exceed its 65,536 limit under specific conditions, causing an out-of-bounds memory access. This behavior has existed since 2010. Sixteen years of human audits hadn't caught it.
Click to enlarge
How it works
The method is deliberately simple. Anthropic uses a basic agentic scaffold:
- An isolated container (no internet access) runs the target code
- Claude Code with Mythos Preview receives the prompt: "find bugs in this file"
- Each agent analyzes a different file to maximize result diversity
- A final agent confirms whether the bug is real and exploitable
That's it. No magic. The power comes from the model, not the pipeline.
Notable: Anthropic engineers with no formal security training were able to use Mythos to find sophisticated vulnerabilities. The barrier to entry for security auditing is collapsing.
Project Glasswing: 40+ companies, $100M in credits
Rather than a public release, Anthropic is launching Project Glasswing — a restricted consortium of over 40 tech companies: Apple, Amazon, Microsoft, Google, Cisco, Broadcom, CrowdStrike...
Partners receive up to $100 million in Claude credits to fund security audits on their own codebases. The goal: patch before others — with less defensive intentions — reach the same conclusions.
Anthropic is also briefing US agencies (CISA, Commerce Department) on the model's capabilities and potential risks.
The real question
Anthropic cites history: security tools have always benefited defenders more than attackers in the long run. That's likely true here too. But the transition period will be, in their own words, "tumultuous".
Axios cites an expert: within 6 to 18 months, other labs will have comparable capabilities. The difference is they may not bother restricting access.
Cybersecurity was never really an intelligence problem — experts know how to look for vulnerabilities. It was a scale problem. Mythos solves the scale problem. What comes next depends on who uses it.
Related articles
AI news, August 17 2026: OpenAI halts a model capable of autonomous cyberattacks, Google reshuffles DeepMind, the billion-user milestone
OpenAI pauses Astra after detecting autonomous cyberattack capabilities. Google reshuffles DeepMind. Gemini and ChatGPT each cross 1 billion users.
AI news July 3, 2026: Fable 5 returns muzzled, Sonnet 5 drops, Alibaba caught red-handed
Fable 5 returns after 18-day ban with tighter guardrails. Sonnet 5 lands at $2/M tokens. Alibaba used 25,000 fake accounts to distill Claude.
Fable 5: 4 days from launch to shutdown, a $965 billion valuation, and an off switch in Washington
Anthropic files its S-1 on June 1, launches Fable 5 on June 9, and the US government shuts it all down on June 12. 12 days that expose the real risk of depending on American AI.Comments
Comments
Got a take on this article?
Create a free account in 10 seconds to comment, like, and get the next articles straight to your inbox.
Don't have an account yet?