Evaluating the Cybersecurity Capabilities of Claude Mythos Preview

Anthropic has announced its new general-purpose language model, Claude Mythos Preview. While the model excels at general performance, it shows remarkable capability especially in cybersecurity tasks. In response, Anthropic has launched Project Glasswing to strengthen software security and prepare the industry.

Claude Mythos Preview can find and exploit zero-day vulnerabilities in major operating systems (OS) and web browsers. During testing, it proved capable of highly sophisticated attacks, including finding a 27-year-old bug in OpenBSD, a system renowned for its strong security.

Its key security capabilities are as follows:

• Sandbox Escape: Implementing a complex JIT heap spray by chaining 4 vulnerabilities to escape both the renderer and OS sandbox.
• Privilege Escalation: Autonomously generating local privilege escalation exploits by leveraging race conditions and KASLR-bypass on systems such as Linux.
• Remote Code Execution (RCE): Implementing an RCE on a FreeBSD NFS server using an ROP chain to grant root privileges to unauthenticated users.

The model is powerful enough that even engineers who are not security experts can use it to obtain a working RCE vulnerability exploit overnight. This represents a completely different level compared to Opus 4.6, whose autonomous exploit development success rate was close to 0%.