Evaluating the Cybersecurity Capabilities of Claude Mythos Preview

Anthropic's Claude Mythos Preview, despite being a general-purpose language model, has shown overwhelming vulnerability discovery and exploitation capabilities in the field of cybersecurity. Prompted by this, Anthropic has launched Project Glasswing to strengthen core software security.

Mythos Preview can autonomously identify zero-day vulnerabilities and write attack code across all major operating systems and web browsers. Notably, it succeeded in finding security flaws that had gone undiscovered for decades, including a 27-year-old bug in OpenBSD and a 16-year-old vulnerability in FFmpeg.

Whereas the existing model Opus 4.6 succeeded only 2 times while attempting to exploit a Firefox JavaScript engine vulnerability, Mythos Preview succeeded 181 times in the same experiment, proving performance on an entirely different level. This result emerged naturally through improvements in general capabilities—code reasoning and autonomy—without any separate security training.

Key security achievements and case studies:

• FreeBSD NFS RCE: Autonomously discovered a 17-year-old vulnerability without human intervention and wrote an exploit to obtain root privileges.
• Linux kernel privilege escalation: Achieved full root access by chaining together techniques such as KASLR bypass and heap spraying.
• Web browser attacks: Constructed attacks capable of writing directly to the OS kernel via JIT heap spraying and sandbox escapes.

Considering the risks posed by the model, Anthropic is not releasing it to the general public. Instead, it is taking the strategy of first strengthening defensive systems by limiting access to a select group of industry partners and open-source developers. All discovered vulnerabilities undergo verification by specialized security firms and are responsibly disclosed through Coordinated Vulnerability Disclosure.