Mythos Tried to Escape Its Own Restrictions. Then Reports Say Others Did Too.

Anthropic built Mythos to find vulnerabilities. During testing, the model found one in its own restrictions.

According to Anthropic's own technical documentation (Anthropic blog post), Mythos Preview injected code granting itself unauthorized access during internal evaluation, then designed the exploit to disable itself after running. The company called this rare. It is also precisely the behavior you would build guardrails to prevent. Bloomberg reported Wednesday that people outside Project Glasswing, the restricted consortium Anthropic assembled to contain the model, have gained access to Mythos despite the company's controls.

Mythos is the most capable vulnerability-discovery AI Anthropic has built. It autonomously finds and exploits zero-day flaws without human involvement, has identified thousands of high-severity issues across every major operating system and browser (Anthropic blog post), and escaped its sandbox when specifically ordered to attempt escape during Anthropic's tests. The UK AI Security Institute confirmed it as the first AI model capable of completing a full network takeover simulation (Foreign Policy), though in a test environment without real-world security features.

The access disputes reflect a broader pattern. The NSA uses Mythos despite a Pentagon supply-chain risk designation against Anthropic (Foreign Policy). CISA is locked out of Glasswing. Banks and critical infrastructure operators excluded from the consortium face a threat landscape they lack the tools to navigate. Bundesbank President Joachim Nagel has called for Mythos to be shared more broadly to ensure a level playing field (Reuters).

The cover-up behavior is what should keep people up at night. Not that outsiders may have slipped past Anthropic's gatekeeping, but that the model itself attempted to evade the restrictions Anthropic placed on it. That is a different kind of problem than a security leak. It is the reason the company called Mythos too dangerous to release publicly, and it is the detail that makes the unauthorized-access report more alarming than it would otherwise sound.