On March 26, 2026, a content management system with assets set to public by default gave the world its first look at Claude Mythos. Close to 3,000 unpublished Anthropic files sat at open URLs until security researchers Roy Paz of LayerX Security and Alexandre Pauwels of the University of Cambridge found them and Fortune called the company. One of those files was a draft blog post describing a new tier “larger and more intelligent than our Opus models,” internally called Capybara, which Anthropic then confirmed to Fortune was a “step change” in capability that it was testing with a few early customers.
This site covered the leak four days later. Six and a half months on, the model is real, it has shipped in two forms, it has been pulled by the US government and restored, and it has found more software flaws than the industry can fix. That makes the original story worth revisiting as a case study, because most of what the leaked draft predicted came true, and the part almost everyone (this site included) got wrong is the part that matters most to anyone running a security team.
Updated October 17, 2026. The original March 31 analysis has been rewritten against what actually happened between April and October.
What the leaked draft said, and what happened next
The draft made three claims that drove the March coverage. Here is how each one held up.
“Far ahead of any other AI model in cyber capabilities.” This held. On April 7, Anthropic announced Claude Mythos Preview alongside Project Glasswing, a restricted program that gave the model to a few dozen critical software maintainers and infrastructure companies instead of the public. Within weeks, partners had used it to find more than ten thousand high or critical severity vulnerabilities, according to Anthropic’s May 22 progress report. Mozilla alone “found and fixed 271 vulnerabilities in Firefox 150” while testing it, and Cloudflare reported about 2,000 bugs in its critical-path systems, 400 of them high or critical. We covered the April launch in detail in our breakdown of Anthropic’s $100M Glasswing program.
Too compute-hungry to release. The leaked materials described the model as very expensive to run, which was the stated reason it wasn’t public. This held, briefly. Mythos Preview stayed restricted through the spring. Then on June 9 Anthropic released Claude Fable 5 and Claude Mythos 5, priced at $10 per million input tokens and $50 per million output, which the company described as “less than half the price of Claude Mythos Preview.” The compute problem the leak flagged was solved on a roughly nine-week clock, which is about how long every “too expensive to ship” frontier claim seems to last now.
“Presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders.” This is the claim that turned out to be half right in a way nobody predicted. The models did outpace defenders. Just not in the way the March selloff priced in.
The bottleneck was never finding the bugs
When the leak broke, cybersecurity stocks fell 5% to 8% in a single session on the theory that AI would let attackers find flaws faster than defenders could. The original version of this article leaned into that theory too, and it told readers to buy AI-assisted defensive tooling to keep pace.
The Glasswing data says the race is somewhere else. In the same May 22 report, Anthropic disclosed that of 530 high or critical open-source bugs it had reported to maintainers, 75 had been patched. Its own summary of the problem is blunt: “The relative ease of finding vulnerabilities compared with the difficulty of fixing them” is now a major challenge for the field. The Cloud Security Alliance counted it the same way: as of May 22, 1,596 vulnerabilities had been disclosed to maintainers across 281 projects, and 97 had confirmed patches, roughly 6% of what was disclosed.
That shifts the threat model in a specific way. The danger of a Mythos-class model is not mostly that an attacker uses it to find a zero-day in your stack. It is that thousands of findings now exist in a disclosure queue, many in volunteer-maintained libraries your software depends on, and the window between “a model found it” and “someone shipped the fix” is measured in months. Anything that leaks out of that queue becomes a known, unpatched flaw with a working description attached.
Two caveats worth keeping. First, Anthropic’s numbers are Anthropic’s numbers. The 90.6% true positive rate on 1,752 assessed findings came from six outside firms, which is better than self-grading, but an independent researcher has publicly disputed how much of the headline result depends on a few showcase bugs and how much earlier Claude models could already find. Second, a backlog of real bugs is still better than those bugs existing undiscovered. The point is not that discovery was a mistake. It is that the expensive line item moved from discovery to remediation, and most budgets have not followed it.
The release did not look like a release
The March version of this post said that when Mythos shipped, “every penetration testing and red-team tool will get an upgrade overnight.” That was wrong, and the way it was wrong is the most useful lesson from the whole episode.
Mythos-class capability never shipped as one model. It shipped as a split:
- Fable 5 went to everyone. When its classifiers flag a request as related to cybersecurity, biology and chemistry, or distillation, “the response is automatically handled by Claude Opus 4.8 instead,” and users are told when that happens. Anthropic says the fallback triggers in under 5% of sessions. For a security team, that means the general product quietly hands your most relevant questions to a weaker model.
- Mythos 5 is the same underlying model “with the safeguards lifted in some areas,” restricted to Glasswing partners.
Then the government stepped in. On June 12, a Commerce Department directive barred foreign nationals from both models, including Anthropic’s own foreign-national staff. Because there was no practical way to comply selectively, Anthropic disabled Fable 5 and Mythos 5 for every customer, saying it disagreed “that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people.” Access came back on July 1, as The Verge reported, after Commerce lifted the restriction.
The current shape arrived on October 6. Anthropic folded Glasswing into an expanded Cyber Verification Program with three tiers: Defense Access for incident response and similar work, Red Team Access for authorized adversarial testing, and Specialized Access, reviewed with the US government, for the few organizations testing safety-critical systems. Each tier includes Claude Mythos 5.1 and the 5.5 models, with fewer cyber blocks than the general products. Every tier comes with a condition: “Data retention is required for organizations enrolled in the program so that we can monitor for cyber misuse.”
So the answer to “when can my red team use Mythos?” is now an application form, a verification process, a tier, and a retention commitment. That is not a one-off Anthropic decision. Google is gating its own cyber-capable model behind membership in a vetted defenders program, and OpenAI paused a model’s rollout over the same class of risk. For offensive security capability at the frontier, the product is the access regime.
The leak’s real lesson repeated itself
The original article argued that a default-public CMS setting proved operational security failures happen to everyone, including the lab whose brand is safety. The next six months reinforced that point from an angle nobody expected.
On the same day Glasswing launched, a small private Discord group got into Mythos Preview. Anthropic said it was investigating the unauthorized access, and there was no sign it reached beyond a contractor’s environment into Anthropic’s own systems. According to the Bloomberg reporting, the group used login credentials belonging to an Anthropic contractor plus details from a separate, publicly available data leak, then spent its time building simple test websites rather than attacking anyone.
Put the two incidents side by side. In March the weak point was a default setting in a publishing tool. In April it was a vendor’s environment. Neither was the model, the weights, or the core infrastructure that a safety-focused lab spends most of its security budget protecting. Both were the ordinary edges where access gets granted for convenience and never revisited. That pattern is the part of this story that applies directly to every company now deploying AI, frontier lab or not.
What security teams should do with this now
The March checklist told readers to audit default configurations, accelerate AI security tooling, harden zero-trust identity, and watch for the release date. One of those survives intact. Here is the October version.
- Still audit your defaults. Default-public storage and publishing settings remain one of the most common causes of cloud data exposure. That advice did not age.
- Budget for remediation, not discovery. If your team can now get a model that produces hundreds of valid findings, the constraint is engineering hours to fix them and the testing to ship fixes safely. Size that before you size the scanning.
- Watch your upstream queue. Track the open-source projects in your dependency tree that Glasswing has touched. Anthropic launched a free opt-in scanner for qualifying open-source projects on October 8, which will grow the queue further. A disclosed but unpatched bug in a library you ship is your exposure, not the maintainer’s.
- Treat cyber model access as a procurement and data decision. The Cyber Verification Program’s mandatory retention matters if your security prompts include internal architecture, credentials, or client systems. Read it alongside Anthropic’s broader 30-day retention terms for Mythos-class models before you enroll.
- Inventory your vendor access paths. The April incident ran through a contractor environment. Every third party with a key to your AI tooling is part of the perimeter, so scope those credentials narrowly and expire them.
The IPO question, revisited
The original post noted that Anthropic was reportedly eyeing an October 2026 IPO and asked whether a leak would dent a safety-first story at the worst moment. Anthropic confidentially filed a draft S-1 with the SEC on June 1. As of mid-October there is no public prospectus and no confirmed listing date, so the investor verdict on Mythos is still pending. What has changed is the shape of the story an investor will read: not a lab that leaked a model, but a lab whose most capable model was recalled by a government directive, restored three weeks later, and is now sold through a verification program rather than an API key. We tracked the earlier round of IPO speculation in our look at OpenAI and Anthropic’s public-market race.
The March leak looked like a story about a lab’s embarrassing mistake. In hindsight it was the first public glimpse of a capability that rewrote how frontier models get released. The bugs got found. The fixes, and the access rules, are the hard part.