Anthropic released Claude Mythos Preview, but did not make it public. The model autonomously found and exploited a 17-year-old vulnerability in FreeBSD without human help.
Access is restricted to nine security-focused organizations. This represents a shift from AI-assisted security to autonomous offensive capability, forcing defenders to operate at machine speed.
Podcast
What You Need to Know:
- Claude Mythos Preview is restricted to AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, and Nvidia
- The model discovered CVE-2026-4747, a 17-year-old remote code execution bug in FreeBSD, and proved exploitation end-to-end
- Anthropic provided $100 million in usage credits, signaling operational-scale defensive deployment
- A 30-to-90-day wave of CVEs is expected across FreeBSD, Linux, macOS, Windows, and major browsers
- The new standard for security tools is autonomous validation and exploitation, not just alert generation
What Is Project Glasswing
April 7th, 2026. Anthropic announces Project Glasswing.
Buried inside is Claude Mythos Preview. Their most powerful model yet. And you cannot go use it.
Not in the normal API. Not as a product. Not as a shiny new chatbot tab.
That alone made me sit up. Because this was not a consumer launch. It was a controlled deployment to a handpicked group of defenders. AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, and Nvidia.
That is not a random customer list. That is cloud, endpoints, chips, banking, operating systems. Basically the people standing closest to the blast radius if something this capable goes sideways.
And Anthropic added another detail that feels small until you think about it: $100 million in model usage credits. That is not marketing confetti. That says they expect real operational volume. Lots of scanning. Lots of testing. Lots of cycles.
They are subsidizing usage at a scale that sounds less like demo the future and more like please run this hard against real systems.
My plain translation: this thing is not being introduced as a clever assistant. It is being introduced as a security program.
Bottom line: Anthropic built a model too dangerous for public release and gave it to the organizations responsible for protecting critical infrastructure.
How Mythos Found a 17-Year-Old Vulnerability
The proof point that changed this from theory to very real is FreeBSD.
Mythos independently found and exploited a 17-year-old remote code execution bug in FreeBSD, now tracked as CVE-2026-4747. The reported impact is brutal: an unauthenticated attacker gets root on any machine running NFS.
Seventeen years.
A bug old enough to vote in some countries. And it was not “Hey, this code looks weird.” Anthropic says Mythos triaged it, reproduced it, and demonstrated exploitation end-to-end with no human guidance.
That is the jump. We have had AI systems that help analysts. We have had copilots that suggest things. This sounds like something closer to an autonomous offensive-capable researcher. It did not stop at suspicion. It kept going until it proved impact.
Picture the moment for the FreeBSD folks. You have a vulnerability sitting there for 17 years, tucked inside a real operating system used by real machines, and then a model walks the chain by itself.
No tired human red teamer with coffee and three monitors. The model working the problem.
And if you are thinking, okay, but it is one bug, yeah, that is the comforting version.
The less comforting version is this: if it does that in one mature system, what happens when you point Mythos-class capability at the long tail of Linux distributions, macOS components, Windows services, browser stacks, all of it?
Because software is full of old rooms nobody has opened in years.
Key insight: Mythos did not assist human researchers. It autonomously triaged, reproduced, and exploited a critical vulnerability without guidance, proving the model operates at a fundamentally different level than previous AI security tools.
Why Anthropic Restricted Access
Anthropic’s argument is pretty direct. Mythos is dangerous as an offensive tool, but uniquely valuable for defenders trying to get ahead of attackers. That is the tradeoff. Restrict it, aim it at defense, buy time.
And to be fair, I get that logic. If you had a system that could autonomously find, reproduce, and exploit serious bugs, you would not toss it into the public internet like free sample day at Costco.
You would want guardrails. You would want named partners. You would want lawyers sleeping slightly better.
But the counterweight here matters. The concern is basically: restricting access to specific defenders does not stop leakage, reverse engineering, or equivalent capability from showing up somewhere else. It only buys time. And it widens the gap between well-resourced organizations and everybody else.
That part hits. Because if you work in security, you already know how this movie goes. The big players get early warning, the rest of the ecosystem gets the patch storm.
Practically, the thing to watch is coordinated responsible disclosure. Anthropic’s own framing points to a 30-to-90-day wave of CVEs across FreeBSD, Linux, macOS, Windows, and major browsers.
So if you are on the defensive side, the move is not philosophical debate first. It is patch prioritization. Inventory. Exposure mapping. Which internet-facing systems cannot wait.
And if you have ever watched a routine patch cycle turn into a full fire drill by lunchtime, you know exactly what kind of workflow-breaker this becomes.
What this means for you: Expect a surge of critical CVEs over the next 30 to 90 days. Prioritize patching internet-facing systems running FreeBSD, Linux, macOS, Windows, and major browsers. This is not a normal patch cycle.
What Security Teams Need to Do Now
One detail I keep coming back to is JPMorganChase being on that early-access list. When a major bank is included from day one, that tells you where this is headed.
Critical infrastructure and financial services are not treating AI-assisted vulnerability discovery like a lab experiment. They are treating it like an operational advantage.
So over the next 12 to 18 months, I think security teams need to start interrogating vendor roadmaps a lot harder. Do not ask, “Do you use AI?” That question is basically useless now.
Ask: can your tool triage a finding, reproduce it, and prove exploitability? Or is it relabeling alerts with fancier wording?
That also raises the bar for anyone building SAST, DAST, or vulnerability management products. Find suspicious code used to sound good.
Now the standard is shifting toward autonomously validate impact. That is a tougher job. It is the difference between a smoke alarm and a firefighter who points to the exact burner you left on.
And this is the question I cannot shake: if defenders get a head start with Mythos-class systems, does that narrow the gap? Or does it define the next arms race, where everybody now has to assume the other side chains bugs at machine speed?
I do not know. But I do know this: once the baseline becomes the model verifies the exploit, security teams will not be judged on how many alerts they saw.
They will be judged on how fast they moved before somebody else did.
That is a different world.
Action steps: Re-evaluate your security tooling. Ask vendors if their tools autonomously validate exploitability or just generate alerts. Prepare for a world where adversaries operate at machine speed and response time defines success or failure.
Frequently Asked Questions
What is Claude Mythos Preview?
Claude Mythos Preview is Anthropic’s most advanced AI model, designed for autonomous security research. It independently discovers, reproduces, and exploits software vulnerabilities without human guidance. Access is restricted to nine organizations focused on critical infrastructure and cybersecurity.
Why did Anthropic restrict access to Mythos?
Anthropic restricted access because Mythos has offensive cybersecurity capabilities that could be weaponized if publicly available. By limiting deployment to trusted defenders like AWS, Apple, CrowdStrike, Google, and JPMorganChase, Anthropic aims to give defenders a head start while minimizing risk of misuse.
What is CVE-2026-4747?
CVE-2026-4747 is a 17-year-old remote code execution vulnerability in FreeBSD that Mythos discovered and exploited autonomously. An unauthenticated attacker can gain root access on any machine running NFS. The bug existed undetected for nearly two decades before Mythos identified it.
How does Mythos differ from other AI security tools?
Previous AI security tools assist human analysts by flagging suspicious code or generating alerts. Mythos operates autonomously. It triages findings, reproduces vulnerabilities, and demonstrates exploitation end-to-end without human intervention. This represents a shift from assistance to autonomous offensive capability.
What should security teams do in response to Project Glasswing?
Security teams should prepare for a 30-to-90-day wave of CVEs across FreeBSD, Linux, macOS, Windows, and major browsers. Prioritize patching internet-facing systems. Re-evaluate security tooling and ask vendors whether their products autonomously validate exploitability or just generate alerts.
Will Mythos-class capabilities become widely available?
Unknown. Restricted access buys time but does not prevent leakage, reverse engineering, or independent development of similar capabilities. History suggests offensive capabilities eventually diffuse. The question is whether defenders gain enough advantage during the restricted period.
What does this mean for the cybersecurity industry?
The baseline for security tools is shifting from finding suspicious code to autonomously validating impact. Vendors building SAST, DAST, or vulnerability management products face higher expectations. Security teams will be judged on response speed, not alert volume, because adversaries will soon operate at machine speed.
Who has access to Claude Mythos Preview?
Nine organizations: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, and Nvidia.
These organizations represent cloud infrastructure, operating systems, chips, banking, and cybersecurity. Anthropic provided $100 million in usage credits to support operational-scale deployment.
Key Takeaways
- Claude Mythos Preview autonomously discovered and exploited a 17-year-old FreeBSD vulnerability without human help, proving AI has moved from security assistance to offensive capability.
- Access is restricted to nine critical infrastructure organizations, representing a controlled deployment strategy that prioritizes defense while managing weaponization risk.
- Expect a surge of 30-to-90-day CVEs across major operating systems and browsers as Mythos findings are responsibly disclosed.
- The new standard for security tools is autonomous validation and exploitation, not just alert generation, raising the bar for vendors and security teams.
- Security teams will be judged on response speed rather than alert volume because adversaries will operate at machine speed.
- JPMorganChase’s inclusion signals critical infrastructure and financial services are treating AI vulnerability discovery as operational advantage, not experiment.
- Restricted access buys time but does not prevent capability diffusion through leakage, reverse engineering, or independent development.