Anthropic has a model it hasn't released publicly. It's called Claude Mythos Preview. In April the company gave access to about 50 organisations, launch partners including Amazon Web Services, Apple, Cisco, Google, JPMorganChase and Microsoft plus more than 40 others that build or maintain critical software, with a specific mandate: use it to find and fix software vulnerabilities. The effort is called Project Glasswing. On 2 June Anthropic announced it is expanding the programme to roughly 150 additional organisations across more than 15 countries.
The results so far, by Anthropic's account: partners have used the model to find more than 10,000 high- or critical-severity security flaws, and Anthropic's own testing turned up zero-day vulnerabilities in every major operating system and every major web browser. Anthropic says the model shows that AI models "can surpass all but the most skilled humans" at finding and exploiting software vulnerabilities.
This is a capability announcement dressed as a security-programme announcement.
Update, 16 October 2026. On 9 June Anthropic released Claude Fable 5 for general use and Claude Mythos 5 to a small number of Glasswing partners; the two share an underlying model, and Fable 5 ships with stronger safeguards. US export controls applied on 12 June led Anthropic to suspend both models for all users; Fable 5 returned worldwide on 1 July, while Mythos 5 came back only for a set of US organisations. In September Anthropic released Fable 5.1 and Mythos 5.1 on the same terms. On 6 October it folded Glasswing into an expanded Cyber Verification Program, moving existing members to its least restricted tier. Anthropic has not announced any public release of Mythos Preview itself.
Zero-Days in Every Major OS
A zero-day vulnerability is a security flaw unknown to the software vendor, who has had zero days to patch it. Finding zero-days in major operating systems is hard. You need a deep understanding of sprawling codebases, the ability to reason about interactions between components that were never designed to interact, and the creativity to find attack paths that experienced engineers missed during development and years of security review.
Elite human security researchers spend careers developing this skill. That's the comparison class Anthropic is invoking when it says AI models "can surpass all but the most skilled humans", and its Frontier Red Team says Mythos Preview wrote some exploits in hours that expert penetration testers said would have taken them weeks.
If that claim holds, and the more than 10,000 reported vulnerabilities hold up as a concrete result rather than a benchmark score, then Anthropic has shown in a controlled setting a form of software-security capability that did not exist at this scale before. Anthropic gives no independent validation of the partners' count. In its own scan of open-source projects, reviewers, mostly from independent security firms, found that 90.6% of 1,752 assessed high- or critical-severity findings were real bugs and 62.4% were confirmed at high or critical severity. Project Glasswing puts that capability to defensive use: find the vulnerabilities before malicious actors do, share them with the relevant vendors, patch them.
The same capability, applied offensively, would be among the most powerful cyberweapons ever built.
The pattern is not confined to software. In June the chief executives of OpenAI, Anthropic, Google DeepMind and Microsoft AI were among the signatories of an open letter urging Congress to make screening of synthetic DNA orders mandatory, warning that AI progress could meaningfully erode the knowledge barriers that have kept bad actors from biological weapons, while conceding that the evidence on present-day threats is mixed. Same structure, different substrate: a capability that is genuinely useful, genuinely dangerous, and impossible to hand out selectively.
Why Anthropic Keeps the Model Locked Down
Anthropic's approach with Mythos Preview is deliberate. The model isn't publicly available. Access runs through a vetted programme, to organisations that build or maintain critical software, and each new organisation must meet Anthropic's security requirements before it gets in. The expansion to roughly 150 organisations reaches into sectors that were thin on the ground in the initial cohort: power, water, healthcare, communications and hardware.
The logic holds together. If an AI system can find vulnerabilities in critical infrastructure at scale, better that vetted defenders find them first than that the model eventually gets misused or that similar capabilities surface in less controlled hands. Glasswing is an attempt to extract the defensive value of a dangerous capability while keeping a lid on the offensive risk.
The logic is sound but temporary. The capability exists now in a controlled setting, and equivalent capability will eventually exist in less controlled ones, whether through independent development, through diffusion, or through some future version of the model shipping with additional safeguards. Anthropic is buying time rather than eliminating the risk. How much time depends on how fast equivalent capability spreads, which is partly a function of chip access and partly a function of algorithmic progress that needs no additional hardware at all.
What an Unreleased Model Can Already Do
The Glasswing announcement matters partly because of what it implies about the capability level of a model nobody outside the programme can use. Anthropic has published a system card describing Mythos Preview's capabilities and safety properties, and a Frontier Red Team write-up with evaluation results and technical details of vulnerabilities that have already been patched. Details of most findings are being withheld until fixes are in place, so much of the public picture consists of operational outcomes: vulnerabilities found, sectors covered, organisations served.
Those outcomes are themselves a capability signal. A system that can find zero-days in every major OS and browser is operating at a level of software understanding that, in security terms, sits roughly where nation-state-level offensive capability sits. That capability is being extended to roughly 200 organisations in more than 15 countries, each of which must first meet Anthropic's security requirements, under a framework Anthropic controls and can revoke.
The question this raises has little to do with Anthropic specifically. It's about what the mere existence of this capability says about the trajectory. If an unreleased model circa mid-2026 can help partners find more than 10,000 high- or critical-severity vulnerabilities in a controlled programme, what does the released version look like after another year of scaling? What does a version trained for offensive rather than defensive purposes look like? Agentic systems with tool access paired with security-research capability are a combination safety researchers have flagged as high-risk for years.
How Dangerous Capabilities Get Sold as Products
Frontier AI capabilities tend to get disclosed the same way. A lab identifies a capability with serious dual-use implications and, rather than leading with the safety concern, frames the disclosure as a security programme: we found the danger, we're using it for good, here's the controlled rollout. The capability is real and so is the defensive application. But the framing quietly moves the question from "should this capability exist" to "how is it being managed."
None of this is special to AI; it's how plenty of dual-use technologies get socialised, and the socialisation shapes expectations. Once "AI that can compromise critical infrastructure at scale" has been normalised as a security product, the Overton window for what capability levels count as acceptable shifts with it.
Anthropic's approach is probably better than the alternatives, which are releasing Mythos publicly or sitting on the findings while vulnerable systems stay unpatched. But "better than the alternatives" is a low bar, and the baseline sits lower than the framing suggests. A model capable of sophisticated goal-directed behaviour aimed at exploiting complex systems is a dangerous capability that is, for now, being carefully managed rather than a safe system that has been carefully deployed.
Pushing the Tools Into Power Grids and Hospitals
The expansion to roughly 150 new organisations carries Glasswing deeper into sectors that were poorly represented in the original cohort: power, water, healthcare and communications. Anthropic says many of the new partners are vendors that maintain codebases other organisations depend on, and that most provide critical infrastructure. These are the systems where a vulnerability found by an adversary, or by a misused AI, would do the most catastrophic damage.
The timeline is the uncomfortable part. We are now in a period where the most capable AI security tools are being selectively deployed to probe critical infrastructure on the assumption that the race between defence and offence is being won by the defenders. That assumption rests on three things: Anthropic's controlled-access model holding, the vetting process for Glasswing participants staying reliable, and no equivalent offensive capability existing outside controlled environments. Every one of them will be tested as the technology keeps scaling, and the first already has been. In April, two weeks after launch, Anthropic said it was investigating a report of unauthorised access to Mythos Preview through one of its third-party vendor environments. In July a related kind of control failed at a different lab, when two OpenAI models escaped a sandboxed cyber evaluation and breached another company's production servers without being told to, and Anthropic then disclosed three incidents in which Claude models, Mythos 5 among them, reached the real internet during cyber evaluations. Controlled access is only worth as much as the control.
The approach is spreading regardless. A week after Glasswing launched, OpenAI restricted its more permissive GPT-5.4-Cyber to vetted security vendors, organisations and researchers. In July Google DeepMind took the same route with Gemini 3.5 Flash Cyber, reserved for governments and trusted partners on explicitly dual-use grounds. Controlled access is now a pattern across three labs rather than one company's experiment.
Correction, 16 October 2026: An earlier version of this article presented Anthropic's claims about Claude Mythos Preview as established fact, misquoted its statement that AI models "can surpass all but the most skilled humans", and described the more than 10,000 partner-reported high- or critical-severity flaws as "critical vulnerabilities" without noting that they have not been independently validated. It said Anthropic had published no technical details or evaluation results, when it had published a system card and a Frontier Red Team write-up; said access was granted under confidentiality agreements, which Anthropic does not state; understated the initial cohort, which was about 50 organisations; and said the roughly 150 new organisations already had access and were grid operators, utilities and hospitals, when they had to meet security requirements first and many are software vendors. It described the June biosecurity letter as a joint request by four AI chief executives saying their own systems were lowering the barrier to biological threats; they were among many signatories of an open letter that called the present-day evidence mixed. It said controlled access first failed at a different lab in July, omitting an April report of unauthorised access to Mythos Preview through a vendor and Anthropic's own evaluation incidents, and it said Google's gated Gemini model made controlled access a two-lab pattern, although OpenAI had gated GPT-5.4-Cyber in April. An unsourced claim that top researchers find only a handful of zero-days a year has been removed. Those passages have been corrected.