Mythos, the model Anthropic held back
Anthropic announced a model in April that it would not release to the public. What Mythos is, what happened next and what it means.
Most AI models are announced on the day anyone can use them. Claude Mythos was not. In April Anthropic described a model that it said could find and exploit software flaws better than all but the most skilled people, and said it would not make it generally available.
Six months later a guarded version is on general sale, after a government letter took it offline for nearly three weeks in June, and the question it raised is still open: who decides when a model is too capable to sell. Here is what happened, and what we take from it.
A leak, then a warning
Its existence became public by accident. On 26 March Fortune reported that Anthropic had left unpublished drafts in a publicly searchable data store. One of them called Mythos “by far the most powerful AI model we've ever developed” and said it was expensive to run and not ready for general release. Anthropic confirmed the work and called the model “a step change and the most capable we've built to date.”
On 7 April it introduced Claude Mythos Preview together with Project Glasswing, a programme to use the model for defence. Launch partners included Amazon Web Services, Apple, CrowdStrike, Google, JPMorganChase, the Linux Foundation and Microsoft, and more than 40 further organisations that maintain critical software received access. Anthropic committed up to 100 million dollars in usage credits; after that, partners pay 25 dollars per million input tokens and 125 dollars per million output tokens.
Its examples were concrete: a 27 year old flaw in OpenBSD that let an attacker crash a machine remotely, a 16 year old flaw in FFmpeg, and a chain of Linux kernel flaws that led to full control of a machine. All were reported and patched. The reason for holding the model back was stated plainly: “We do not plan to make Claude Mythos Preview generally available.” If such capabilities spread, Anthropic argued, the fallout for economies, public safety and national security could be severe.
What others found
The UK AI Security Institute tested the model within a week. It became the first model to complete the institute's 32 step simulated attack on a corporate network from start to finish, in 3 of 10 attempts, and averaged 22 steps where the next best model managed 16. The institute added a caveat that matters: its test networks had no active defenders, so “we cannot say for sure whether Mythos Preview would be able to attack well-defended systems.”
Others questioned how exclusive the capability is. On the day of the launch, Stanislav Fort of the security company AISLE gave the vulnerable code from Anthropic's examples to small and cheap models. All eight found the FreeBSD flaw Anthropic had showcased, including one with 3.6 billion active parameters, though they were handed the right function directly. His conclusion: the advantage lies more in the system around a model than in any single model.
Finding has also proved easier than fixing. Anthropic says Glasswing partners found at least 129'000 verified vulnerabilities between April and July. In September Patrick Garrity of VulnCheck checked the 26'153 findings Anthropic claims from its own scanning: about one in ten had reached its public disclosure ledger, and fewer than one in a hundred were marked fixed. “The receipts are starting to trickle in, they just don't reconcile,” he wrote.
Fable, and a switch off
On 9 June Anthropic released Claude Fable 5, “a Mythos-class model that we've made safe for general use,” and Mythos 5 for its Glasswing partners. They are the same model with different safeguards. In Fable, separate classifiers watch for requests about cyber attacks, biology and chemistry, and attempts to copy the model, and hand them to an older Claude model.
Three days later the US Department of Commerce wrote to Anthropic that any foreign person, inside or outside the United States and including Anthropic's own staff, now needed an export licence to use either model. Researchers at Amazon had reportedly found a way around Fable's guardrails. Anthropic could not check the nationality of every user, so it wrote that it must “abruptly disable Fable 5 and Mythos 5 for all our customers.” Analysts at CSIS questioned the legal basis, since nothing is shipped: users reach the model on Anthropic's servers.
On 30 June Commerce lifted the controls. In return, Al Jazeera reported, Anthropic agreed to detect and address security risks, to help set standards for future models and to report malicious activity. Both models returned on 1 July. Version 5.1 followed on 1 September, with Mythos 5.1 open only to verified organisations, so far in the US. On 6 October Anthropic folded Glasswing into a wider Cyber Verification Program with three tiers, and every applicant for the highest tier is reviewed with the US government.
Why it was handled this way
Anthropic's stated reason is that capability ran ahead of safeguards. “Mythos-class models have reached a threshold where they present significant risks,” it wrote when Fable launched, and its answer was a sequence: defenders first, classifiers next, a guarded general release last. In September its chief executive, Dario Amodei, went further: “We must slow the pace at which we improve the capabilities of AI models.”
It is no longer one company's path. When OpenAI released GPT-6 Astra in September, it was the first OpenAI model to meet its own “critical cybersecurity capability threshold”, and it went to cyber defenders before anyone else. Staged access by trust is becoming the normal way to release the strongest models.
What it means for a company
Three things follow. The best models now come in tiers of trust, and the public version may hand some questions to an older model. A model can disappear overnight for reasons that have nothing to do with you: on 12 June every Fable customer lost it the same day. And finding flaws is now the cheap part of security. Patching is the hard part, which is why the institute's advice to companies is unglamorous: timely updates, strong access controls, secure configuration and good logging.
This is why we keep a company's knowledge outside any single model, in Twin, and why for critical work we bring Eigna: a private model of a company's own, built by our partner Eigna Labs, running in its own cloud or on its own servers and designed to run offline in closed networks. It will not match a frontier model on every task, and for most confidential work it does not have to. A model that runs on your own hardware does not vanish because a supplier receives a letter.
