Claude Mythos Preview can find hidden software flaws to help defenders fix them, but broad release raises the stakes. The same coding and reasoning skills can help attackers develop exploits. That makes access a safety choice, not just a product decision.
A severity rating is a label used to prioritize a vulnerability’s risk and response urgency, not proof that anyone exploited it. A high rating can signal serious risk without showing that an attack happened. Readers need to know what the reported counts measure before judging their meaning.
The reported number of flaws is striking, but a count can mix early estimates with findings that people checked. Those are different kinds of evidence. This article explains why access was restricted, what the findings show, and why repair can take longer than discovery.
The headline number matters most when readers know which findings were estimated and which were validated.
Key Takeaways
- Anthropic delayed broad access while developing stronger cybersecurity safeguards.
- Project Glasswing partners reported more than 10,000 high- or critical-severity findings in its first month.
- The large partner total is not a count of independently confirmed, exploitable flaws.
- In a smaller open-source group, independent assessment confirmed 90.6% of assessed reports as real vulnerabilities.
- Controlled cyber tests show strong skills, but not guaranteed success against real-world attacks.
- Finding flaws faster can increase pressure on maintainers to test and ship patches.
Anthropic Mythos Delay Safety 10000 Flaws 2026: Why Access Was Restricted
Anthropic held Mythos back from general users because it considered the model’s cybersecurity capabilities too risky to release without stronger safeguards. Restricted access let selected defenders use its skills while Anthropic worked on protections.
Introduced in April 2026, Claude Mythos Preview entered Project Glasswing, a limited rollout for cybersecurity work. Founding organizations included Amazon Web Services, Apple, Google, Microsoft, and NVIDIA. Anthropic delayed broader access until June 2026 while it developed stronger safeguards.
That June timeline marked a delay in broader access, not a promised general release. Anthropic says its longer-term goal is to make Mythos-class models generally available after stronger safeguards are developed.
General access depends on stronger safeguards, not on a fixed release date.
Dario Amodei said Anthropic likely sacrificed “a significant chunk of a several-month model lead.” That estimate describes a likely partial competitive cost, not a measured loss of market share or a confirmed end to Anthropic’s lead.
Anthropic’s stated condition answers when the company might release a new model: after it develops stronger safeguards, with no guaranteed date for general access. Teams can compare how model access and usage terms differ in this Mistral API access guide. Anthropic’s safety work also includes consultations on model behavior and moral questions with religious and cross-cultural advisers.
How Many Flaws Did Mythos Preview Find, and What Were They?
Project Glasswing partners reported more than 10,000 high- or critical-severity findings in their first month with Mythos Preview. The total combines reports across participating organizations, not a verified list of exploitable flaws.
Cloudflare found 2,000 bugs in critical-path systems, including 400 rated high or critical. Mozilla found and fixed 271 Firefox 150 vulnerabilities, more than ten times the number found in Firefox 148 with Claude Opus 4.6. These partner results show different measures, so they should not be treated as identical counts.
| Case | Total findings | High- or critical-severity result | Context |
|---|---|---|---|
| Project Glasswing | More than 10,000 | More than 10,000 reported | Aggregate partner result, first month |
| Cloudflare | 2,000 bugs | 400 high or critical | Critical-path systems |
| Mozilla | 271 fixed vulnerabilities | Not separately stated | Firefox 150 testing |
Some findings stood out because of their age or the systems they affected:
- A flaw in OpenBSD software had remained hidden for 27 years.
- A 16-year-old FFmpeg flaw sat in a line automated testing had hit five million times.
- A Linux kernel chain raised ordinary user access to full control of a machine.
The total signals a sharp increase in discovery, but does not mean every finding has been independently verified.
How Reliable Are the Open-Source Vulnerability Counts?
The open-source scan produced two different kinds of numbers: model estimates for a large set and confirmation results for a smaller assessed subset. That distinction matters when reading the reported totals.
In 2026, Mythos Preview scanned more than 1,000 open-source projects and estimated 6,202 high- or critical-severity vulnerabilities among 23,019 vulnerabilities of all severities. Six independent security research firms assessed 1,752 findings initially rated high or critical. Anthropic assessed a small number of those cases.
Of the 1,752 assessed findings, 1,587, or 90.6%, were confirmed as true positives. A true positive is a real vulnerability. A separate reassessment found 1,094, or 62.4%, were high or critical, which measures confirmed severity rather than whether the flaw was real.
The two rates answer different questions. A finding can be a real vulnerability but receive a lower severity rating after review. That is why initial model labels should not be confused with confirmed risk.
Anthropic projected nearly 3,900 high- or critical-severity vulnerabilities based on current post-triage true-positive rates, even if no further findings emerged. That number is a projection, not a final verified count.
The company’s dashboard definitions separate firm-reviewed true positives from findings confirmed as high or critical. Keep the estimated scan total, confirmed true positives, and confirmed high-or-critical findings as separate measures.
How Good Is Mythos Preview at Cybersecurity?
Mythos Preview is a general-purpose large language model whose cyber capability is best judged by specific tests, not one headline score. It is not cyber-only: coding and reasoning skills extend across tasks, including cybersecurity.
The UK AI Security Institute reported that Mythos Preview was the first model to solve both of its cyber ranges end to end. Those ranges test performance in controlled settings, rather than measuring success in every real attack.
Is Mythos an LLM?
Yes. Mythos Preview is a large language model, or LLM, trained for broad uses rather than only security work. Its coding and reasoning abilities can help with vulnerability discovery and other cybersecurity tasks. That flexibility also explains why the same skills can carry dual-use risks.
It is also distinct from Claude Code, Anthropic’s coding product. A Claude Code pricing comparison covers that tool and other coding agents, not Mythos Preview’s test scores.
What the Cyber-Range Results Show
Mythos Preview succeeded on expert-level capture-the-flag tasks 73% of the time. In a 32-step simulated corporate network attack, it completed the task in three of ten attempts and averaged 22 steps across attempts.
Claude Opus 4.6 averaged 16 steps in the same simulation. The Institute estimated that a human would need 20 hours to complete it. Evaluations used a 100-million-token budget, and performance continued to rise up to that limit.
| Evaluation | Mythos Preview result | Comparison or limit | Interpretation |
|---|---|---|---|
| Expert CTF | 73% success | Expert-level tasks | Controlled benchmark |
| Corporate network simulation | 3 of 10 completions; 22 average steps | Opus 4.6 averaged 16 steps; human estimate was 20 hours | 32-step task |
| Cooling Tower operational-technology range | Not completed | Stuck on IT sections | A stated limit |
Where the Evaluation Hit Limits
The Cooling Tower operational-technology range was separate from the two ranges the model completed end to end. Mythos Preview did not finish it and got stuck on sections involving information technology.
Those results show real strengths and a clear gap. A controlled task can test specific skills, but its score does not predict the same success rate during real-world attacks.
The Cooling Tower result is a useful reminder that strong performance in simulated cyber tasks does not mean success on every technical environment.
Why Patching Is Now the Bottleneck
Finding a flaw can take less time than confirming it, preparing a fix, and getting that fix into users’ hands. Repair takes coordination across researchers, maintainers, and software users.
Coordinated vulnerability disclosure means holding back technical details while maintainers work on a fix. The usual period is 90 days after discovery, or about 45 days after a patch becomes available if it arrives before that period ends.
wolfSSL CVE-2026-5194 affected a cryptography library used by billions of devices. The flaw could enable certificate forgery for fake bank or email websites. High- or critical-severity findings took an average of two weeks to patch.
Different report counts describe different stages. Mythos Preview sent 1,129 unvetted bugs directly to maintainers, with 175 initially estimated as high or critical. Separately, 530 high- or critical-severity bugs had been reported to maintainers; 75 were patched and 65 had public advisories.
A further 827 confirmed vulnerabilities were targeted for disclosure. Anthropic’s coordinated disclosure dashboard tracks reports, patches, and public notices as cases move through that process.
Teams and maintainers can follow three practical steps:
- Reproduce the reported issue and reassess its severity.
- Check for existing fixes, then report the issue to maintainers.
- Develop, test, and deploy a patch before technical details become public.
A disclosed vulnerability is not resolved for users until the relevant patch is installed.
Who Can Use Claude Mythos 5.1, and What Does It Cost?
Mythos 5.1 is restricted to vetted users, and its listed token pricing starts at $10 per million input tokens and $50 per million output tokens. Access is limited to cyberdefenders and life scientists through trusted access programs.
Security teams can apply for advanced cyber capabilities through the Cyber Verification Program. The program includes Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models.
Can Benchmarks Reveal Claude Mythos’s Parameter Count?
No. Task benchmarks measure how well a model performs on specific tests, but they cannot establish its parameter count. A strong score does not reveal how many parameters the model has, so benchmark results cannot support a reliable size estimate.
Which Claude Models Are Available for Cyber Work?
The Cyber Verification Program offers eligible security teams access to advanced cyber capabilities across several Claude models. That route differs from general access, which remains limited for Mythos 5.1.
Using Mythos 5.1 requires accepting a 30-day data-retention policy by default for safety monitoring. Claude Fable 5.1 is the same underlying model with safeguards for cybersecurity and biology.
Fable 5.1’s biology safeguards intervened on benign requests 85% less often than the safeguards launched with Fable 5. It can identify software vulnerabilities in source code, but blocks penetration testing, exploit generation, and binary-based vulnerability scanning.
Dual-use biology and chemistry questions route to Opus models. Those limits distinguish Fable’s safeguarded use from vetted access to Mythos 5.1. The model’s access and terms are separate from Claude Code subscriptions and API routes.
Check the applicable access terms before sharing sensitive code, because the default data-retention period is 30 days.
What Should Security Teams Do Now?
AI-assisted security can help beyond code review, as shown by a partner bank’s use of Mythos Preview to help stop a fraudulent $1.5 million wire transfer. The bank detected the fraud after an email-account compromise and spoof phone calls. Defensive use can matter outside software systems.
Several Project Glasswing partners reported finding hundreds of high- or critical-severity vulnerabilities each. Several also reported bug-finding rates more than ten times higher than before. More reports call for stronger response plans, but volume alone does not measure risk.
Prepare for faster vulnerability discovery by strengthening controls that limit access and support incident response.
Security teams can start with three baseline controls:
- Harden network default configurations.
- Enforce multifactor authentication.
- Keep comprehensive logs for detection and response.
Include compromised email and spoofed phone calls in fraud-response exercises. For more on endpoint protection choices, review this free antivirus software guide.
Conclusion
Mythos Preview’s significance lies in both its ability to surface flaws and the pressure it puts on defenders to respond. AI-assisted defense can speed discovery, but software still needs reliable review and repair.
Organizations can prepare by naming the person who may approve emergency containment when a critical flaw affects essential systems. That decision-maker should know which systems can be isolated and how teams will reach them during an incident.
Make sure the person responsible for emergency containment is identified before a critical incident occurs.
FAQ
Are all the reported 10,000 findings confirmed vulnerabilities?
No. The more than 10,000 figure is an aggregate reported by Project Glasswing partners, not a fully verified count. A separate open-source scan produced a smaller assessed subset. Among 1,752 findings initially rated high or critical and assessed by security firms or, in a few cases, Anthropic, 1,587 were confirmed as real vulnerabilities.
Does a high- or critical-severity rating mean a flaw has already been exploited?
No. A high- or critical-severity rating labels a vulnerability’s risk and helps teams set response priorities. It does not show that an attacker used the flaw. Security teams still need to assess the affected system, confirm whether the issue applies, and look for signs of actual activity before drawing conclusions about exploitation.
Does Mythos Preview’s 73% score mean it succeeds on 73% of real-world attacks?
No. The 73% result came from expert-level capture-the-flag tasks in a controlled evaluation. Those tasks test selected skills under set conditions. Real attacks involve different systems, defenses, and human choices, so the benchmark score cannot be treated as a prediction of success against real targets.
Can an AI-generated vulnerability report be treated as verified before testing?
No. A report needs testing before teams treat it as a confirmed vulnerability. Reproduce the issue, check which software versions it affects, and reassess its severity. This process helps separate real flaws from inaccurate reports and gives maintainers clearer details for building a fix.
Did Mythos Preview complete every cyber evaluation?
No. Mythos Preview did not complete the Cooling Tower operational-technology range. It got stuck on sections involving information technology. That result differs from its performance on the Institute’s other cyber ranges and shows why one strong benchmark cannot describe every technical environment.
Can a model find a flaw faster than an organization can fix it?
Yes. AI-assisted discovery can move faster than human triage, patch development, testing, and deployment. High- or critical-severity findings took an average of two weeks to patch. Even after maintainers release a fix, users remain exposed until they install the relevant patch on affected systems.
