The same AI that can help defenders find vulnerable code can also make it easier to identify paths into that code. For AI users, the stakes reach beyond a single tool: flaws in widely used software can affect businesses, public services, and personal data. Coordinated vulnerability disclosure is the practice of privately reporting a software flaw and allowing time for its maintainer to patch it before public details are released. That process gives software makers time to respond, though it cannot remove every cybersecurity risk.
The reported scale of the findings has drawn attention to a hard trade-off. AI can speed up security work, but broader access could help people with harmful aims find weaknesses, too. The issue matters to anyone who relies on software, from a small business using cloud tools to a family keeping devices updated. This article explains what the reported totals count, what testing showed, and what remains uncertain about repair and access. The central question is whether a controlled rollout can give defenders time to act while limiting the risks of wider access.
Key Takeaways
- Claude Mythos Preview was kept from general public release.
- Project Glasswing began as a restricted defensive effort.
- The 10,000-plus total is a partner-reported count, not an independently confirmed tally.
- Human review and patch work can take weeks.
- Mythos 5.1 access remains limited to vetted users.
Why Did Anthropic Delay Claude Mythos?
Anthropic held back Claude Mythos Preview from general release because it considered the model’s capabilities too risky to make broadly available without stronger safeguards. Restricted access let selected defenders test it while Anthropic studied risks tied to cybersecurity and biology.
Anthropic did not announce a public release plan for the April model. It described the model as a general-purpose frontier system, rather than a tool built only for security work.
Powerful cyber and biology skills can help researchers, but they can also help people pursue harmful goals. Wider access needs safeguards that match those risks.
What Kind of Model Is Claude Mythos?
Claude Mythos Preview is a large language model, or LLM, trained to understand and generate text, code, and other content. Anthropic called it a general-purpose frontier model because it sits among its most capable models.
Anthropic has not supplied a parameter count, so claims about its size in parameters would be guesswork. Its scale is better described through tasks it can perform, such as finding software flaws and handling complex cyber exercises.
Readers looking for a plain overview of Claude’s uses and limits should keep the model separate from the chat service. The model is the underlying system; the service is one way people can use it.
Why the April Launch Was Restricted
Anthropic announced Claude Mythos Preview on April 7, 2026, and said it did not plan a public release. On that date, it also launched Project Glasswing, a restricted defensive rollout with 12 named partners.
The partners were Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and Anthropic. The effort focused on using the model to find and address weaknesses in important software.
Anthropic committed up to $100 million in Claude Mythos Preview usage credits and $4 million in direct donations to open-source security groups. The April arrangement was a limited defensive deployment, supported by substantial usage credits and open-source security donations.
Anthropic Mythos Delay Safety 10000 Flaws 2026: How Reliable Is the Count?
More than 10,000 high- or critical-severity findings is a reported partner total, not a count of 10,000 independently confirmed and patched flaws. The distinction matters: the number combines partner reports, while a separate review examined a defined open-source group.
Project Glasswing partners reported finding more than 10,000 high- or critical-severity vulnerabilities in important software during its first month. That figure is an aggregate, not the result of one independent audit.
Separately, Claude Mythos Preview scanned more than 1,000 open-source projects and identified 23,019 vulnerabilities of all severities. It initially rated 6,202 as high or critical.
The review then assessed 1,752 of those initially high- or critical-rated findings. The table shows how the open-source counts changed at each stage.
| Triage stage | Count | What the count represents |
|---|---|---|
| All open-source findings | 23,019 | All severities |
| Initially high or critical | 6,202 | Model-rated findings |
| Assessed | 1,752 | Reviewed findings |
| Confirmed true positives | 1,587 | Verified vulnerabilities |
Of the 1,752 assessed findings, 1,587, or 90.6%, were confirmed as true positives. A true positive is a reported flaw that review confirms is real.
The confirmed true-positive rate answers whether a reported finding was a real vulnerability. A different measure found that 1,094, or 62.4%, of the assessed findings were confirmed as high or critical severity.
Those rates are not interchangeable. One tracks whether a flaw exists; the other tracks how serious confirmed findings were after review.
At its post-triage true-positive rates, Mythos Preview was estimated to have surfaced nearly 3,900 high- or critical-severity open-source vulnerabilities, even if it found no more. A third-party review of the ledger also examines how reported findings and severity ratings can differ.
Read the totals as stages in a review process, not as interchangeable counts of verified, severe and fixed vulnerabilities.
What Did Mythos Find in Operating Systems and Browsers?
The findings included vulnerabilities in every major operating system and web browser, not just obscure packages. Some were old, yet they had escaped earlier review and testing.
A remote crash, a missed code flaw, and a path to full control show different kinds of risk. Each example points to a separate challenge for software security teams.
Old Flaws in OpenBSD and FFmpeg
Mythos Preview found a 27-year-old OpenBSD flaw that could let an attacker remotely crash a machine by connecting to it. A crash can interrupt service, but it does not by itself mean the attacker gained control.
It also found a 16-year-old FFmpeg flaw in code that automated testing tools had exercised five million times. The tools did not detect the vulnerability.
Repeated testing can expose many bugs, but running code millions of times does not guarantee that a test will catch every flaw. Some weaknesses depend on unusual inputs or conditions that a test does not cover.
- OpenBSD crash: A remote connection could make the machine stop responding.
- FFmpeg testing miss: Tools exercised the vulnerable code five million times without finding the flaw.
- Linux kernel chain: Mythos linked vulnerabilities to move from ordinary access to complete control.
A Linux Vulnerability Chain
The Linux example involved privilege escalation, which means gaining more rights inside a system. Mythos Preview autonomously chained kernel vulnerabilities to move from ordinary user access to complete control of a machine.
A person with ordinary access may have limited ability to read files or change settings. A successful chain can turn that foothold into broad control, making it more dangerous than an isolated crash.
That kind of chain can matter in critical software because one weak point may open a route to another. The Linux example shows why a chain of individually reported vulnerabilities can matter more than a single isolated bug.
Why Are Patches Lagging Behind AI Findings?
The bottleneck has shifted from finding flaws to verifying, disclosing and fixing them before attackers can take advantage. Discovery is only the start; each report still needs human review and repair.
A Mythos Preview high- or critical-severity finding took an average of two weeks to patch. The clock includes work that a model cannot finish simply by producing a report.
Partner Results Show Faster Discovery
Several Project Glasswing partners reported finding bugs at rates more than 10 times higher. Cloudflare found 2,000 bugs across critical-path systems, including 400 rated high or critical.
Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview. That was more than 10 times the number found in Firefox 148 with Claude Opus 4.6.
One finding involved wolfSSL, a software library used to secure connections. The certificate-forgery flaw, assigned CVE-2026-5194, could help an attacker impersonate a trusted bank or email site.
Verification and Repair Take Human Time
Coordinated vulnerability disclosure commonly allows 90 days after discovery, or about 45 days after a patch becomes available, before public details appear. That window gives maintainers time to respond without leaving users uninformed forever.
Reports move through several hands before a fix reaches users. A security team or maintainer may need to:
- Reproduce the issue.
- Reassess its severity.
- Check for an existing fix.
- Write a report for maintainers.
- Prepare and deploy a patch.
Of 530 disclosed high- or critical-severity bugs, 75 had been patched, and 65 had public advisories. Another 827 confirmed vulnerabilities were being prepared for disclosure.
Maintainers may have limited staff and time, especially on open-source projects. The Open Source Security Foundation’s Alpha-Omega project supports triage work, while Anthropic’s public-beta Claude Security is a separate remediation tool for Claude Enterprise customers, not Mythos access.
Anthropic’s vulnerability disclosure dashboard tracks reported findings, maintainer responses, and patch status. A separate antivirus guide for computer users explains why antivirus does not replace software updates.
Keep a vulnerability report’s disclosure status separate from its patch status, because a reported issue is not yet a deployed fix.
How Strong Is Mythos at Cybersecurity Tasks?
Mythos Preview outscored Claude Opus 4.6 on CyberGym vulnerability reproduction, but that result measures a specific cybersecurity task. It is not a general coding score, and it does not show how the model would act on a live network.
On CyberGym, Mythos Preview scored 83.1%, compared with 66.6% for Claude Opus 4.6. The test measured how well each model could reproduce known vulnerabilities.
Scores and Multi-Step Attack Simulations
That CyberGym result is not a SWE benchmark score. SWE tests software engineering work, while CyberGym focuses on vulnerability reproduction.
The UK AI Security Institute found that Mythos Preview succeeded on expert-level capture-the-flag tasks 73% of the time. No model had completed tasks at that level before April 2025.
In “The Last Ones,” a 32-step corporate-network simulation estimated to take humans 20 hours, Mythos Preview completed every step in three of ten attempts. It averaged 22 of 32 steps.
Claude Opus 4.6 averaged 16 of 32 steps in the same simulation. The UK institute’s evaluation also found that Mythos Preview did not complete “Cooling Tower,” an operational-technology range.
In that range, the model got stuck in information-technology sections rather than completing the operational-technology task. The evaluations used a 100-million-token budget, and performance continued to scale up to that limit.
What the Evaluations Do Not Prove
Cyber ranges are controlled environments, not copies of every company network. They can test specific skills without showing how a model would handle a real system’s unique defenses.
The ranges lacked common real-world protections, including active defenders and defensive tools. They also did not penalize actions that would trigger security alerts.
That gap matters because live defenders can spot unusual activity and respond while an attack is underway. A simulation without those obstacles cannot show how well a model handles that response.
Claims about AI capability and test evidence should name the task and test conditions, not treat one score as proof of every skill. Treat cyber-range success as evidence about tested cyber tasks, not proof of performance against a live network with active defenders.
Who Can Access Claude Mythos 5.1 in 2026?
As of October 2026, Claude Mythos 5.1 is available through verification programs to vetted users, not to the general public. There is no general-release date; broader access depends on stronger safeguards.
Access is limited to approved cyberdefenders and life scientists through verification programs. Anthropic announced the newer model on September 1, 2026, describing gains in cybersecurity and biology.
The timeline shows how the access model changed.
| Date | Model or program event | Access or status |
|---|---|---|
| April 7, 2026 | Claude Mythos Preview announcement | Restricted defensive rollout |
| September 1, 2026 | Claude Mythos 5.1 announcement | Gains in cybersecurity and biology |
| October 6, 2026 | Cyber Verification Program expansion | Approved users gain program access |
Vetted Access, Models and Pricing
The expanded Cyber Verification Program has three tiers for qualifying security teams. It includes Claude Mythos 5.1, Claude Opus 5.5, Claude Sonnet 5.5, and future models.
Existing Project Glasswing members transition to the Specialized Access tier. Pricing starts at $10 per million input tokens and $50 per million output tokens.
Using the program requires accepting a 30-day data-retention policy by default. Anthropic uses that retention for safety monitoring.
For other Claude updates, recent Claude model and access news covers changes beyond the verification program.
Safeguards and the Restricted Alternative
Claude Fable 5.1 uses the same underlying model as Mythos 5.1 and can identify source-code vulnerabilities. Its safeguards block penetration testing, exploit generation, and binary-based vulnerability scanning.
Fable 5.1’s biology safeguards intervene on benign requests 85% less often than the safeguards launched with Fable 5. That comparison concerns biology safeguards, not access to Mythos.
Security teams should treat access as a controlled privilege, not as a sign that every use case is safe. Review the program rules before code enters the service.
Claude Security is in public beta for Claude Enterprise customers, separate from Mythos access. Claude Opus 4.7 was used to patch more than 2,100 vulnerabilities in three weeks.
Security teams should confirm their eligibility tier and review the default retention policy before using the program with sensitive code.
Conclusion
Anthropic’s decision reflects a difficult balance between giving defenders powerful tools and limiting capabilities that could be misused. Defensive access can help teams find flaws sooner, while delays between discovery and repair leave software exposed.
Software and security leaders can reduce that gap by reviewing their dependency lists, update routines, and patch deployment practices. They should know which teams own each critical system and how urgent fixes reach users.
Security planning also needs more than new AI tools. Strong update habits and clear ownership help turn a confirmed finding into a real fix. Start by checking which critical systems depend on third-party software and how quickly their security updates reach users.
FAQ
What does “zero-day vulnerability” mean in discussions of Mythos?
A zero-day is a flaw unknown to the affected software maintainer or one without an available fix when discovered. The term does not mean every Mythos finding was a zero-day. Some findings may describe older flaws, or issues maintainers already knew about. The key point is whether defenders have a fix before attackers can use the weakness.
Does finding a vulnerability prove that it can be exploited?
No, a model’s report does not by itself prove that a flaw can be exploited. Reviewers need to reproduce the issue and assess its severity. In the open-source review, 1,587 of 1,752 assessed reports were confirmed as true positives. Those confirmed findings were only a subset of the assessed results, and confirmation still differs from showing real-world exploitation.
Why can fixing AI-found vulnerabilities take weeks?
A patch took an average of two weeks for Mythos Preview high- or critical-severity findings. Maintainers and security teams must reproduce the issue, judge its severity, and check for existing fixes. They then need to report the flaw clearly, design a safe patch, test it, and deploy it. Limited staff or complex software can add more time.
What should software users do while vulnerability fixes are being prepared?
Install security updates promptly when they become available, and keep automatic updates enabled where practical. Multifactor authentication can make stolen passwords less useful, while hardened defaults reduce exposed features. Comprehensive logs can help teams spot unusual activity and respond sooner. These steps lower risk, but they do not replace a patch for the specific flaw.
Did Mythos find a vulnerability that automated tests had missed?
Yes, Mythos Preview found a 16-year-old vulnerability in FFmpeg code that automated tools had exercised five million times without detecting the flaw. That result does not mean testing failed in every way; automated tests catch many bugs. It shows that repeated runs cannot guarantee coverage of every input, code path, or unusual condition.
Can Claude Fable 5.1 perform the same cybersecurity tasks as Mythos 5.1?
No, Claude Fable 5.1 can identify vulnerabilities in source code, but its safeguards block several offensive tasks. Those limits include penetration testing, exploit generation, and binary-based vulnerability scanning. Fable uses the same underlying model as Mythos 5.1, yet access and safeguards shape what users can do. Shared model foundations do not mean the products offer the same functions.
