clauding.de
DE
• 2 min read AI-generated

Claude Mythos Preview: Anthropic Launches Project Glasswing to Harden Critical Software

Copy article as Markdown

Anthropic announces a new model whose cybersecurity skills are too strong to ship publicly. Instead: Project Glasswing — a closed program to protect critical infrastructure.

Anthropic Claude Mythos Security Glasswing Research
Featured image for "Claude Mythos Preview: Anthropic Launches Project Glasswing to Harden Critical Software"

This is a first: on April 7, Anthropic introduced a new Claude model — and at the same time decided not to release it.

Claude Mythos Preview is a general-purpose model in the same league as Opus 4.6, but with one trait that put the safety team on alert: it is exceptionally good at finding and exploiting security vulnerabilities.

What Mythos found in testing

The numbers from Anthropic’s internal red team are impressive and unsettling at the same time:

  • Thousands of high- and critical-severity bugs across operating systems, browsers and crypto libraries
  • A 27-year-old bug in OpenBSD’s SACK implementation
  • A 16-year-old vulnerability in FFmpeg’s H.264 codec
  • Multi-stage exploits, including one that chained four separate flaws into a working privilege escalation

More than 99 percent of the findings are still unpatched. Anthropic is documenting them via SHA-3 commitments, keeping the details sealed until vendors have had time to react.

Project Glasswing

Instead of putting the model on the API, Anthropic launched Project Glasswing: a closed circle of partners that get to use Mythos Preview to harden the most critical software stacks in the world. The list includes AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks.

The advice for everyone else is blunt: speed up patch cycles, rethink your disclosure policy and start running current LLMs over your own code — because whatever Mythos can do today, an open-source competitor will be able to do in a few months.

My take

This is the first major release where Anthropic holds a model back purely on safety grounds. Until now those calls were theoretical; now they are real. The interesting tension is the dual nature of Glasswing: it is protection and competitive moat at the same time. Whoever is on the inside hardens their systems before everyone else. For independent maintainers and small open-source projects it means the gap between ‘a bug exists’ and ‘a bug gets exploited’ is going to shrink, not grow.

Sources