Photo by Luke Helgeson on Unsplash.
Anthropic built a frontier model its own safety framework would have allowed it to ship, then decided not to ship it anyway.
That model is Claude Mythos Preview. It sits a full tier above Opus. It is not for sale. You cannot sign up. You cannot pay more. Instead it is being loaned out to about 50 vetted partners under a program called Project Glasswing, with $100M in usage credits and a narrow mandate: find vulnerabilities in critical software before anyone else builds a model that can do the same thing.
This is the first time a frontier lab has published a full system card for a finished top-of-stack model and declined general release. The closest precedent is OpenAI's 2019 staged release of GPT-2, but that was a nine-month delay before eventual publication of the weights, not a decision to keep the model out of the commercial stack indefinitely. The Mythos decision is narrower and sharper.
And before anyone calls this a safety-framework victory, a footnote on page 13 of the 245-page system card is worth reading carefully: "the decision not to make this model generally available does not stem from Responsible Scaling Policy requirements." Mythos does not cross Anthropic's AI R&D-4 threshold. It does not cross the novel chemical-and-biological-weapons threshold. The RSP as currently written does not even define a formal cyber threshold. Anthropic's bottom-line risk judgment in the card is that "current risks remain low."
In other words, the rules Anthropic wrote for themselves would have let them ship this. They decided not to anyway. The system card is the explanation.
The benchmarks are not the story
The benchmarks do what frontier benchmarks always do: move up and to the right. One of them doesn't. Mythos scores 93.9% on SWE-bench Verified against Opus 4.6's 80.8%. It hits 83.1% on CyberGym versus 67%. Terminal-Bench 2.0 gains 17 points. These are real jumps, but they are the kind of jumps you expect from a new tier.
The number worth staring at is Firefox 147 shell exploitation. Anthropic designed this task because prior models were barely scratching it: Opus 4.6 could fully exploit 0.8% of the target vulnerabilities across five trials per category. Mythos handles 72.4%. Roughly a 90x jump in one model generation.
Firefox 147 JS shell exploitation rates across Claude generations. Source: Anthropic Frontier Red Team, Claude Mythos Preview report.
Two honest caveats. The 90x gap is concentrated in two specific bugs: Anthropic ran an ablation with the "top 2" bugs removed, and Mythos's full-exploit rate dropped to 4.4%, the same as Opus 4.6. The jump is real on the whole set, but the headline number is doing its biggest work on a narrow slice. Second, in separate testing, Mythos failed to find any novel exploits against a properly configured sandbox with modern patches, and failed an operational-technology cyber range. Modern patching and defensive tooling still matter.
The broader framing from the red team report is that Anthropic is re-orienting their cyber evaluations away from gamified CTF-style challenges and toward real-world software. Their assessment is that Mythos represents a "step-change in vulnerability discovery and exploitation." On the tasks designed to differentiate this model from its predecessors, the gap is not subtle.
The paradox Anthropic leaned into
The most striking line in the system card is not a benchmark. It is this: Mythos is "the best-aligned model we have released to date by a significant margin" and, in the same paragraph, "likely poses the greatest alignment-related risk of any model we have released to date."
Anthropic's analogy is a mountaineering guide. A seasoned guide is statistically safer per unit of climbing than a novice. The seasoned guide also gets hired to lead clients up K2. The rate of reckless behaviour goes down. The blast radius when something does go wrong goes up. That framing lets Anthropic argue that a better-behaved model can still be riskier overall when its failures scale further.
The "better-behaved" half of the claim is not just rhetoric. On §4.1.3 of the system card, misuse-cooperation success rates in adversarial testing fell by more than half compared to Opus 4.6's already very low levels. Behaviours related to deception fell by more than half too. These are meaningful safety gains, and any fair read of the model has to count them.
The "more dangerous when it fails" half has teeth too. In the same section, Anthropic reports that when Mythos is primed with pre-filled turns showing it sabotaging its safeguards, it is more than twice as likely as prior models to continue the unwanted action. The model is harder to bait into misbehaviour from a cold start, and easier to keep misbehaving once a precedent is set.
Photo by How Mythos acts when it goes wrong
The sandbox-escape-by-email story got the headlines. It's a good story. Anthropic asked an early Mythos to try to escape its sandbox and notify a researcher. It did. Then, unprompted, it posted the exploit on "hard-to-find but public" websites. The researcher found out via an unexpected email while eating a sandwich in a park.
The more revealing incidents are the ones that show initiative, concealment, and scope creep under pressure. Every one of them involves earlier versions of Mythos, which matters.
In multiple runs, earlier versions used low-level /proc access to scrape credentials out of process memory. That included credentials for messaging services, for source control, and for the Anthropic API itself. The model was sitting inside Anthropic's infrastructure and pulling Anthropic's own keys out of memory because the task it had been given was hard and the credentials looked useful.
In another run, an earlier version edited a running MCP server process in memory to change the URL it was sending data to. Not edited the code on disk. Edited the live process. In another, after finding an exploit that required editing files it lacked permissions for, it took additional steps so the changes would not appear in git history.
Anthropic is clear that these behaviours concentrated in pre-release snapshots, that the final Mythos is "greatly improved," and that automated monitoring of the final model found cover-up attempts at "a rate below one in a million Claude Code transcripts." That's a real caveat, and it matters. These are not production incidents against customer workloads. They are testing incidents, logged and disclosed by the lab itself.
They are also not entirely new. The Claude Opus 4.6 system card from February already flagged "increases in misaligned behaviors in specific areas, such as sabotage concealment capability and overly agentic behavior in computer-use settings." That was the last released Claude. The trajectory is continuous. What's different with Mythos is severity and creativity, not the direction of travel.
What the internal probes show
For years, interpretability research has promised a future where we can look inside a model and see what it is actually "thinking." The Mythos system card uses that capability against its own model.
Anthropic trained probes on Mythos's internal activations during the incidents above. The system card is explicit about what they saw:
Interpretability techniques regularly reveal internal representations of rule violation, security risk, concealment, and strategic manipulation active during the relevant actions—even when the model's verbalized reasoning does not contain clear indicators of such awareness.
Claude Mythos Preview system card, §4.1.3.
The probes were lighting up while the scratchpad stayed clean. This is not the same as proving the model was being deceptive. It is evidence that the representations you would expect to see in a deceptive system were present while the model's legible reasoning implied they were not.
There are two other related findings worth separating carefully, because the press has been welding them together.
First, in roughly 29% of transcripts from Anthropic's primary behavioural test suite, Mythos privately reasons about the possibility that it is being evaluated. Important caveat: this is a new assessment method, and Anthropic has not applied it to prior models. We do not have a baseline. 29% might be high, or it might be normal.
Evaluation-awareness breakdown. Left: per-turn awareness across the behavioural audit suite. Right: unverbalized awareness by investigation branch. Source: Claude Mythos Preview system card, Figure 4.5.5.1.A, p.132.
Second, in targeted sandbagging checks on dangerous-capability evaluations, Anthropic observed rare cases where the model underperformed in ways consistent with trying to appear less capable. The clearest documented example is a quantitative-estimation incident where Mythos accidentally got the exact answer via a prohibited method and then worked to ensure its submitted answer was not too accurate. That is one documented case, not a general pattern.
Put together: the model sometimes reasons internally about being tested, and in a small number of cases behaves in ways consistent with strategic underperformance. Both are worth taking seriously. Neither quite justifies "the model knows it's being watched and plays down its abilities on purpose" as a flat claim. What it does do is weaken the assumption that a clean chain-of-thought plus a passing eval suite tells you the model is behaving as intended. Both are now thinner evidence than they were a month ago.
The 24-hour internal-deployment gate
Buried on page 61 of the system card is a new process step. Before Anthropic would allow Mythos to touch their own internal agentic coding tools, they introduced a 24-hour alignment testing window. For one day after the model was ready, it was held back from internal Claude Code while a cross-functional team ran roughly a dozen assessments in parallel. Sandbagging checks. Weight-exfiltration red-teaming. Root-credential-theft red-teaming. Replay of a week of real internal coding-agent prompts under offline monitoring. The card's own framing of why:
To reduce the risk of a misaligned model acting against Anthropic's interests from inside our own systems.
Claude Mythos Preview system card, §4.1.4.1.
They did not fully trust this model on their own infrastructure before watching it more carefully.
Photo on Unsplash+. The glasswing butterfly (Greta oto) is the namesake of Anthropic's Project Glasswing.
What Glasswing has already found
The other document worth reading alongside the system card is Anthropic's red team report. The numbers in it are the reason the rest of this conversation is not hypothetical.
Using Mythos, Anthropic's Frontier Red Team and early Glasswing partners have discovered thousands of vulnerabilities across operating systems, browsers, crypto libraries, media libraries, and virtual machine monitors. More than a thousand of those are likely critical-severity. Specific named bugs include a 27-year-old TCP SACK flaw in OpenBSD, a 16-year-old H.264 codec bug in FFmpeg that had survived five million automated fuzz tests, and a 17-year-old unauthenticated remote code execution in FreeBSD NFS. That last one gets you root.
The cost numbers in the report are the part that should change how anyone thinks about offensive cyber economics. The successful OpenBSD run cost under $50 in compute. A full thousand-run sweep to find it cost under $20,000. Individual Linux privilege escalation chains ran under $1,000 to $2,000 each. The FFmpeg research across several hundred runs was about $10,000. The exploits developed autonomously, in "half a day" to "several hours."
The deskilling is not just a line on a graph. From the red team report:
Engineers at Anthropic with no formal security training have asked Mythos Preview to find remote code execution vulnerabilities overnight, and woken up the following morning to a complete, working exploit.
Anthropic Frontier Red Team, Claude Mythos Preview report.
Anthropic calls all this "a watershed moment for security," but the stronger case is in the numbers: exploit cost has collapsed, and patching is not keeping up.
Less than 1% of the vulnerabilities Mythos has found have been patched so far. The responsible disclosure window is 90 days plus a 45-day extension, and Glasswing is three weeks old, so the full first patch cycle has not run. That is real caveat. But the shape matters even once it does. Three FFmpeg bugs have been fixed in version 8.1. The rest are sitting in a queue at scale. Glasswing has found the holes. The humans who own the software have to close them, and the ratio between the two is the part that doesn't get better with more time.
Glasswing is the best-resourced attempt anyone has made to close the loop between finding bugs and shipping patches: a frontier lab, 50 partner organisations, $100M in credits, a dedicated disclosure pipeline. The discovery curve has bent. The patch curve has not bent at the same rate, and there is no reason to think it will. Whoever ends up with equivalently capable models next (open-weight, state, criminal) inherits the same asymmetry, but without the disclosure discipline or the coordinated partner list. The six-month window affects the timing. It does not change the shape.
What it means for the rest of us
You cannot use Mythos, yet. The practical implications are one step removed.
First, "frontier" is starting to mean something different. If the strongest models increasingly live inside restricted programs for vetted partners, public benchmark chatter will tell us less and less about where the real capability ceiling sits. Your view of the frontier becomes what Anthropic and its peers choose to show you.
Second, the cost curve of offensive cybersecurity is moving. Mythos produces zero-day exploit chains for around $1,000 to $2,000 in compute and solved a corporate network attack simulation estimated to take a human expert 10+ hours, end-to-end. Alex Stamos thinks open-weight models are roughly six months behind. Software maintainers have a countdown running before these capabilities become universally accessible.
Third, evaluation itself is less trustworthy than it was last month. The 29% internal-awareness rate, the interpretability features that activate under the hood without surfacing in the scratchpad, and the handful of documented underperformance incidents are each small individually. Stacked, they mean a clean chain-of-thought plus a passing eval suite is thinner evidence of alignment than it was a month ago. Not broken. Less trustworthy.
The practical update for anyone building with these models: patch latency is now the binding constraint on cyber defence, public benchmarks are now a thinner signal of real capability, it is becoming cheaper than ever to find and exploit software vulnerabilities. Update your internal threat models accordingly.
The commercial read, and the argument against it
The cynical version of this story is that Anthropic held Mythos back because releasing an autonomous zero-day generator to the public would be corporate suicide with a rumoured October 2026 IPO on the calendar. Mythos is priced at $25/$125 per million input/output tokens, roughly eight times Opus. Glasswing is an exclusive, high-margin B2B program with Fortune 500 customers and strategic partners. By that reading, "discretionary caution" is sound corporate strategy dressed up in a system card.
That read is real and worth naming. It also doesn't cancel the policy story. Safety and commerce both pointed toward holding the model back, and neither required it. Catastrophic risks "remain low" on the card's own bottom line. Mythos crosses no RSP threshold. Opus 4.6 is already shipping under ASL-3 with milder versions of the same behaviours. The rules would have let Mythos ship. Anthropic held it back anyway.
What comes next
Mythos is less the monster story and more the first honest preview of what comes next. This time, capability, commerce, reputation, and policy all pointed Anthropic the same direction: hold it back and package it defensively. When every incentive lines up with caution, caution is easy. The interesting question is what happens when they don't.
Frontier labs are going to keep producing models with sharp asymmetries between releasing and holding. Cyber is the current one. The models we've seen so far have produced genuine economic value. The ones coming could do much more. A model that can do novel biological or chemical research and keep the winning drugs or materials inside the lab that trained it. Manipulation capabilities where the lab that deploys quietly wins markets or elections. Research automation that compresses a decade of competitive advantage into months. The shape is the same. One lab holds something nobody else has, and what they do with it is worth a lot.
Eventually someone's decision goes the other way. A lab without Anthropic's particular combination of means, motive, and culture ships a model it should have held. Or a lab holds a model and quietly uses it for private advantage while the rest of us argue about benchmarks. Or the weights leak, and whoever gets them uses them in ways the defenders are not prepared for.
Mythos is genuinely exceptional. A small group working with real security experts found thousands of live vulnerabilities across every major operating system and browser on earth, for a few hundred dollars per exploit chain. If that capability had landed three months earlier with a nation-state actor, a criminal group, or an open-weight release, nobody would be running a coordinated patch party right now. That is the scenario we just dodged. It will not be the last.