Claude Mythos for defenders: what changes when finding exploits costs nothing

What is Claude Mythos?

Claude Mythos is a general-purpose Anthropic model with unusually strong security skills, first shown as "Claude Mythos Preview" on April 7, 2026. Anthropic didn't train it as a hacking tool. It says the cyber ability comes from strong coding and reasoning. But the cyber results are why the industry noticed.

According to Anthropic, Mythos Preview:

• found a 27-year-old bug in OpenBSD that let an attacker remotely crash any machine running it, just by connecting to it;
• found a 16-year-old bug in FFmpeg in a line of code automated tools had hit five million times without catching it;
• chained several Linux kernel vulnerabilities to go from ordinary user to full control of the machine;
• scored 83.1% on CyberGym, a vulnerability reproduction benchmark, against 66.6% for Claude Opus 4.6.

Anthropic also wrote that engineers "with no formal security training" asked Mythos Preview for remote code execution bugs overnight and woke up to a complete, working exploit.

All of that is Anthropic's own reporting. Independent checks and skeptics are below.

Is Claude Mythos available to the public?

No. As of November 2026, Mythos is available only through Anthropic's trusted access programs. I've seen a lot of "Mythos goes public" headlines, so here is the precise state of things:

Notice the wording: Fable 5.1 and Mythos 5.1 are "the same model, but with different levels of safeguards." The capability is public. What's gated is permission to use it offensively. And the CVP's Defense tier now accepts smaller security firms, open-source maintainers and regional hospitals. Access is widening. It isn't open.

What did independent evaluators find?

The UK AI Security Institute confirmed a real step up, and was careful about what it didn't prove. AISI tested Mythos Preview before the announcement and published its results on April 13, 2026:

• On expert-level capture-the-flag tasks, which no model could complete before April 2025, Mythos Preview succeeded 73% of the time.
• On "The Last Ones," a 32-step simulated corporate network attack that AISI estimates takes a human about 20 hours, Mythos Preview was the first model to finish end to end, in 3 of 10 attempts. It averaged 22 of 32 steps. The next best model, Claude Opus 4.6, averaged 16.
• It could not complete AISI's operational technology range, "Cooling Tower." It got stuck on the IT sections.

AISI's own caveat is the important one. Its ranges have no active defenders and no penalty for tripping alerts, so "we cannot say for sure whether Mythos Preview would be able to attack well-defended systems." Their advice to organizations was the basics: security updates, access control, configuration, logging.

The Centre for Emerging Technology and Security (CETaS) at the Alan Turing Institute said some of Anthropic's claims have been independently corroborated, "the full picture will take months to emerge," and that the best response is to "build pipelines that enable organisations to patch at machine speed and scale."

Is the Mythos hype overstated?

Partly, on discovery. Less so on exploitation. The fairest critique came from AISLE, a security startup. In April it took Mythos's showcase bugs, isolated the relevant code, and gave it to small, cheap, open-weight models. Its summary: they "recovered much of the same analysis." A follow-up scanner found the flagship FreeBSD bug, CVE-2026-4747, with models as small as 3.6 billion active parameters. AISLE sells AI security too, so weigh it accordingly. Hornetsecurity's analysis openly asked whether the launch was partly a marketing strategy.

Anthropic's own numbers deserve a careful read too. By May, Mythos Preview had flagged 23,019 potential vulnerabilities across more than 1,000 open-source projects, 6,202 of them rated high or critical by the model. Of the 1,752 high or critical findings people had checked, 90.6% were real bugs, and 62.4% were confirmed as high or critical. That's a strong hit rate. It is also a reminder that "found" and "matters" are different numbers.

And VulnCheck's 2026 data adds a counterweight: AI-discovered vulnerabilities are not, so far, more likely to be exploited than ones found by people.

Here is how I read it. If small models find the same bugs once pointed at the right code, discovery is becoming a commodity. That doesn't make the threat smaller. It makes it wider. It's the same economics we saw in the AI agent swarm attack on Hugging Face.

Why do patches turn into exploits faster now?

Because a patch is a map. This gets too little attention. The scary stories are about zero-days. The practical risk is the bug that already has a fix, on the server you haven't updated yet.

Until recently, an unpatched server was "fine for now" as long as nobody had published an exploit. Turning a fix into an attack took a skilled researcher days or weeks, so most known bugs were never weaponized. That buffer is disappearing. Give a model the patched and unpatched versions, and it can diff them, work out what the fix closed, and build the exploit.

Anthropic tested exactly this. It gave Mythos Preview a list of 100 known Linux kernel CVEs from 2024 and 2025. More than half of the attempts succeeded. One documented exploit cost under $1,000 at API prices and took half a day. A harder one, which needed several bugs chained, took under a day and under $2,000. Kernel exploitation is about as hard as this work gets. Most of what sits on your perimeter is easier.

The wider data points the same way. Google's threat intelligence group says 2026's growth in exploitation is "concentrated in the rapid weaponization of n-days," and suggests attackers may be using LLMs to analyze patch differences. CrowdStrike's CTO, in Anthropic's Glasswing launch, put it bluntly: "what once took months now happens in minutes with AI."

Our own analysis of CISA's Known Exploited Vulnerabilities catalog shows where this lands. For CVEs published in 2026, the median time from publication to CISA confirming exploitation was 4 days, and 27% were confirmed the same day or earlier. The full method is in our time to exploit guide.

The version you think of as "safe because there's no public exploit" isn't safe. It's just untested.

Why is chaining the real danger?

Because most real compromises are built from findings that each look minor. Anthropic says it has nearly a dozen examples of Mythos Preview chaining two, three and sometimes four Linux kernel vulnerabilities into root. In one case it used one bug to defeat address randomization, a second to read a kernel structure, a third to write to freed memory, and a heap spray to land the write. In browsers, it chained four bugs to escape both the renderer and OS sandboxes.

Each of those bugs alone is a medium-severity ticket. Together, they're a takeover. Scanners rate them one at a time. Attackers, human or model, don't.

What do we see from the outside?

The same pattern, with known CVEs and no frontier model needed. In an external penetration test this year for a smart-traffic company, the entire scope was one asset: a public CVAT annotation server. Here is the chain we validated:

We deliberately stopped there. The published advisories describe the rest of the path: read the key, forge an admin session, then remote code execution. We documented it. We didn't run it.

Nothing in that chain was a zero-day. Every step was public. A scanner would have reported an outdated version and an open registration page as two separate, medium-priority items. What made it critical was putting them together, and that is exactly the work models are making cheap. This is the gap between vulnerable and exploitable.

Who gets Mythos first, and why does it matter?

The organizations that were already strongest. Glasswing's launch partners are among the best-defended companies in the world. Anthropic says partners found at least 129,000 verified vulnerabilities between April and July 2026. Together with Anthropic's own open-source scans, more than 33,000 have been rated critical or high so far. Good news for their code and the open-source projects they maintain.

But look at what Anthropic itself named as the constraint in May: not finding bugs, but "the human capacity to triage, report, and design and deploy patches." At that point, 75 of the 530 high or critical bugs Anthropic had reported were patched. Big organizations have the people to absorb that flood. Most don't. CETaS made the same point: "less resourced organisations need to be sufficiently supported in testing and patching their systems."

I'd call it the rich getting richer. To be fair, the October CVP expansion is a real step toward smaller defenders. But attackers don't apply for access tiers, and the gap between "gated" and "public" keeps shrinking.

What should defenders do?

Stop measuring how many bugs you can find. Measure how fast you know which ones are exploitable from the outside. This week:

• List every internet-facing asset that runs a version behind. Appliances, dashboards, annotation and ML tools, admin panels. Not what the CMDB says. What actually answers.
• Treat a published patch as a countdown, not a ticket. If the fix is public, assume the exploit is hours away for anyone with a capable model.
• Re-rate "authenticated only" bugs. If anyone can sign up, or credentials are sitting in a public repo, every authenticated bug is effectively unauthenticated.
• Chain your own findings. For each medium finding, ask what it connects to. Models chain by default.
• Drill the 24-hour question. A critical CVE drops. How long until you know if you're exposed, and if it's exploitable in your setup?
• Build the patch pipeline before the flood. Glasswing showed the bottleneck is triage and deployment. Find yours before the bugs arrive.
• If you qualify, apply for CVP Defense Access. Use the same capability on your own code and assets.
• Test from the outside continuously. An annual pentest is a snapshot. Model-speed exploitation runs every day. See external penetration testing and what AI pentesting can and can't do.

The bottom line

Sources

1. Anthropic, Project Glasswing: Securing critical software for the AI era (April 7, 2026; updated October 6, 2026)
2. Anthropic Frontier Red Team, Claude Mythos Preview's cybersecurity capabilities (April 7, 2026)
3. Anthropic, Project Glasswing: An initial update (May 22, 2026)
4. Anthropic, Introducing Claude Fable 5.1 and Claude Mythos 5.1 (2026)
5. Anthropic, Expanding the Cyber Verification Program (October 6, 2026)
6. UK AI Security Institute, Our evaluation of Claude Mythos Preview's cyber capabilities (April 13, 2026)
7. CETaS, Alan Turing Institute (Hicks, Attridge, Janjeva), Claude Mythos: What Does Anthropic's New Model Mean for the Future of Cybersecurity? (April 2026)
8. AISLE, AI Cybersecurity After Mythos: The Jagged Frontier and System Over Model (April 2026)
9. Hornetsecurity (Paul Schnackenburg), Claude Mythos – Facing the Coming Bug-Calypse (June 10, 2026)
10. Google Threat Intelligence Group, Vulnerability Discovery and Exploitation Trends in the AI Era (September 30, 2026)
11. VulnCheck, State of Exploitation 1H-2026
12. CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.30, Cylent analysis)
13. NVD, CVE-2025-68430 (CVAT directory traversal)