Anthropic’s Restricted Mythos Model Puts AI’s Cybersecurity Double Edge in Focus

SAN FRANCISCO, April 9 (TodayViralUSA) – Anthropic’s decision to keep its most capable new artificial intelligence model out of public release has set off a broad debate among security professionals. The question is whether AI systems that can find software vulnerabilities at scale will end up helping defenders more than attackers.

The company announced Claude Mythos Preview on Tuesday, together with Project Glasswing, an initiative that gives a limited group of organizations access to the model for defensive security work. Anthropic said Amazon Web Services, Apple, Google, Microsoft and Nvidia are among the launch partners, and that more than 40 other organizations, including CrowdStrike and Palo Alto Networks, are taking part.

What the model can do

Anthropic describes Mythos as a general-purpose model, not one trained specifically for security. It says the model’s ability to find vulnerabilities comes from its strong coding and reasoning skills. According to the company, Mythos has identified thousands of high-severity vulnerabilities, including flaws in every major operating system and web browser. One example was a 27-year-old bug in OpenBSD, an operating system known for its focus on security. SecurityWeek reported that the model also found a 16-year-old flaw in video software and was able to chain together multiple Linux kernel weaknesses into working exploits.

Anthropic positions Mythos as a new tier above its Opus models. The company said it does not plan to make the model generally available. Instead, it wants to study how such systems might eventually be deployed safely. Descriptions of the model had first appeared in late March, when Fortune found them in a publicly accessible data cache, a report that briefly weighed on cybersecurity stocks.

Chief Executive Dario Amodei wrote on X that the dangers of getting the approach wrong were obvious, but that getting it right could produce a fundamentally more secure internet.

Experts: the race is already on

Security practitioners largely welcomed the defensive framing. Many cautioned against treating it as a head start for the good side. In commentary collected by Security Magazine, the BeyondTrust security team said current-generation AI tools have already shrunk the time between disclosure of a critical vulnerability and its exploitation to minutes instead of weeks. The team argued that state-sponsored and criminal groups are already using AI-assisted tooling, so the starting gun fired before Mythos existed.

Others said the main bottleneck in cybersecurity is not finding bugs but fixing them. Organizations already struggle to work through large patch backlogs. A sudden flood of newly discovered vulnerabilities could overwhelm maintainers, particularly volunteer-run open-source projects, unless coordinated disclosure and remediation keep pace.

Government engagement

Anthropic said it has been in ongoing discussions with U.S. officials about the model’s capabilities, including the Cybersecurity and Infrastructure Security Agency and the Center for AI Standards and Innovation. The company had previously reported disrupting what it described as a largely AI-orchestrated espionage campaign in late 2025, an episode it has cited as evidence that offensive use of AI is no longer hypothetical.

A test case for restricted release

Policy analysts say Glasswing will serve as an early test of whether AI developers can manage dangerous capabilities by controlling who gets access rather than by withholding the technology entirely. Its success will likely depend on how quickly partners turn the model’s findings into patches, and on whether comparable capabilities show up in openly available models. Some security experts estimate that could happen within months.