← Back to feed

Anthropic’s Claude Mythos Preview — the cybersecurity model the company restricted to 40 vetted enterprise partners because it can autonomously exploit vulnerabilities in every major OS and browser — was accessed by an unauthorized group on April 7, the same day it was publicly announced.

The mechanism is specific and worth stating plainly: the group used knowledge of Anthropic’s URL naming conventions, obtained from a prior Mercor data breach, to guess the model’s endpoint. A third-party contractor with legitimate Glasswing-adjacent access provided the credential entry point. Members of a private Discord channel focused on unreleased AI models have been using the model regularly since then, providing Bloomberg with screenshots and a live demonstration as evidence.

What Actually Broke

Project Glasswing was designed around controlled distribution. Named partners — AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks — received access for defensive security work. About 40 additional organisations were also granted access. Anthropic’s rationale: no public release, no API tier, vetted partners only.

The breach did not defeat Anthropic’s access controls. It went around them. The attack surface was not Anthropic’s own infrastructure — it was a vendor’s environment, where Anthropic’s endpoint naming conventions were predictable and the authentication layer was under someone else’s control.

That distinction is the story. “Restricted to vetted partners” is a distribution policy. It is not a technical control. If the URL is guessable and a contractor account can reach it, the restriction is only as strong as the weakest vendor’s credential and naming hygiene.

The Mercor connection adds a second layer: the group’s knowledge of Anthropic’s model URL structure came from a separate breach of an unrelated platform. One compromise enabled another.

Anthropic’s Response

“We’re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments,” an Anthropic spokesperson said. The company has found no evidence the activity impacted Anthropic’s core systems or extended beyond the vendor environment.

The group’s stated intent is exploratory, not malicious — and they have reportedly avoided using Mythos for actual cybersecurity tasks to reduce their detection footprint. The same group reportedly accessed other unreleased Anthropic models through similar methods.

The Structural Problem

Mythos’s capabilities are what make the breach consequential. A model that can chain previously unknown vulnerabilities across large codebases, autonomously complete 32-step enterprise network attacks, and achieve 73% on expert-level CTF tasks is not a model you want in uncontrolled circulation — regardless of the stated intent of whoever has access.

The incident does not mean controlled distribution is the wrong strategy for dangerous frontier AI. It means controlled distribution fails as the primary safeguard when endpoints are guessable and vendor environments inherit trust they cannot enforce. Technical controls — authentication at the model layer, not just the distribution layer — are what Glasswing’s architecture apparently lacked at the vendor boundary.

Anthropic has no announced timeline for public Mythos access. The UK AI Security Institute’s independent evaluation, published April 14, confirmed its capabilities are at a threshold qualitatively different from standard frontier models. The investigation is ongoing.