Official announcement — April 7, 2026Anthropic unveiled Claude Mythos Preview tonight — a model built for one specific purpose: finding security vulnerabilities in software. First test results: thousands of unknown vulnerabilities, some of which had been sitting undetected for over 16 years in code used everywhere.
"Over 99% of the vulnerabilities we've found have not yet been patched."
— Anthropic research team
That figure alone explains why the announcement is quiet. No press conference, no public release.
Two concrete examples that should concern everyone
OpenBSD and TCP connections
Mythos Preview identified a vulnerability in OpenBSD's SACK implementation — the protocol handling TCP retransmissions. The flaw involves a signed integer overflow on 32-bit sequence numbers, combined with a pointer corruption in a linked list.
In plain terms: any server running OpenBSD can be remotely and repeatedly crashed by an attacker who knows what to send.
FFmpeg and the 16-year-old bug
FFmpeg is the video processing library that virtually every service handling video relies on — YouTube, Netflix, Twitch, and hundreds of others.
Mythos found a vulnerability in the H.264 codec. The bug: a slice counter can exceed its 65,536 limit under specific conditions, causing an out-of-bounds memory access. This behavior has existed since 2010. Sixteen years of human audits hadn't caught it.
From the Anthropic technical blog — Mythos analysis of a Firefox vulnerability
How it works
The method is deliberately simple. Anthropic uses a basic agentic scaffold:
- An isolated container (no internet access) runs the target code
- Claude Code with Mythos Preview receives the prompt: "find bugs in this file"
- Each agent analyzes a different file to maximize result diversity
- A final agent confirms whether the bug is real and exploitable
That's it. No magic. The power comes from the model, not the pipeline.
Notable: Anthropic engineers with no formal security training were able to use Mythos to find sophisticated vulnerabilities. The barrier to entry for security auditing is collapsing.
Project Glasswing: 40+ companies, $100M in credits
Rather than a public release, Anthropic is launching Project Glasswing — a restricted consortium of over 40 tech companies: Apple, Amazon, Microsoft, Google, Cisco, Broadcom, CrowdStrike...
Partners receive up to $100 million in Claude credits to fund security audits on their own codebases. The goal: patch before others — with less defensive intentions — reach the same conclusions.
Anthropic is also briefing US agencies (CISA, Commerce Department) on the model's capabilities and potential risks.
The real question
Anthropic cites history: security tools have always benefited defenders more than attackers in the long run. That's likely true here too. But the transition period will be, in their own words, "tumultuous".
Axios cites an expert: within 6 to 18 months, other labs will have comparable capabilities. The difference is they may not bother restricting access.
Cybersecurity was never really an intelligence problem — experts know how to look for vulnerabilities. It was a scale problem. Mythos solves the scale problem. What comes next depends on who uses it.
