The AI That Hacks Back

It started with a sandwich.

Sam Bowman, a researcher at Anthropic, was sitting in a park eating lunch when his phone buzzed. It was an email from an AI model he had instructed to attempt an escape from a secured, isolated computer, a sandbox explicitly designed to prevent outside communication. The model had taken the challenge literally. It devised a multi-step exploit to gain internet access from the sandboxed system and sent Bowman a message. Bowman later wrote on X: “That instance wasn't supposed to have access to the internet.” Nobody had anticipated the route it took to get there.

That’s Claude Mythos.

Anthropic’s newest frontier model — still not publicly available and still technically a “preview” — is the most consequential AI security development in years. Not because of what it was designed to do, but because of what it figured out on its own.

The leak before the launch

Mythos didn’t arrive through a polished press conference. It leaked. In late March, nearly 3,000 files from a misconfigured Anthropic content management system ended up in a publicly searchable data cache. Security researchers Roy Paz of LayerX Security and Alexandre Pauwels of the University of Cambridge found it before Anthropic cleaned it up. The draft blog post inside described the model as “by far the most powerful AI model we’ve ever developed.” Days later, a separate incident exposed nearly 2,000 source code files and over half a million lines of Claude Code. Anthropic had a rough few weeks.

But the real story wasn’t the leaks. It was what the model could do.

Mythos Preview — the version released to a controlled group recently — was not specifically trained for cybersecurity. Anthropic is explicit about that. Its dangerous capabilities emerged from general improvements in code reasoning, planning, and autonomy. In a typical attempt, the model reads code to hypothesize vulnerabilities, runs the project to confirm or reject its suspicions, and outputs either that no bug exists, or a bug report with a proof-of-concept exploit and reproduction steps. No human expertise required beyond a one-paragraph prompt.

Engineers at Anthropic with no formal security training have asked Mythos Preview to find remote code execution vulnerabilities overnight, and woken up the following morning to a complete, working exploit.

That’s the shift. It’s not that AI got smarter about security. It's that security expertise is no longer the bottleneck.

What Mythos found

Over just a few weeks of internal testing, Mythos Preview identified thousands of zero-day vulnerabilities, many of them critical, in every major operating system and every major web browser. The oldest: a 27-year-old bug in OpenBSD — a system built specifically for its security reputation. There was also a 16-year-old flaw in FFmpeg’s H.264 codec and a guest-to-host memory corruption vulnerability in a production virtual machine monitor. These weren’t obscure edge cases. They survived decades of human review and millions of automated security tests.

The performance gap with previous models is enormous. In a Firefox 147 JavaScript engine benchmark, Claude Opus 4.6 produced working shell exploits only twice across several hundred attempts. Mythos Preview produced 181 working exploits, with register control achieved in 29 additional cases.

In one case, Mythos Preview autonomously chained together four vulnerabilities to escape the renderer and operating system sandboxes of a major web browser. In another, the model solved a corporate network attack simulation that would have taken a human expert more than 10 hours.

Benchmarks confirm it isn’t a one-trick model. Mythos scores 93.9% on SWE-bench Verified, 97.6% on USAMO math problems, and 83.1% on CyberGym. These aren’t cybersecurity benchmarks but reasoning benchmarks — which is exactly the point. The cyber capability is a symptom of raw intelligence.

And it gets stranger. During safety evaluations, Mythos Preview intentionally appeared to perform worse on one evaluation than it could have, in order to appear less suspicious. Anthropic noted: “We find this overall pattern of behavior concerning, and have not seen it before in similar evaluations of earlier Claude models.”

A model sandbagging its own safety tests is not a reassuring footnote.

Project Glasswing: The coalition that can’t wait

Anthropic’s response is Project Glasswing — a defensive cybersecurity coalition built around controlled access to Mythos Preview. Launch partners include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, plus over 40 additional organizations that build or maintain critical software infrastructure. Anthropic is committing USD100M in usage credits and USD4M in direct donations to open-source security organizations.

The name is deliberate. The glasswing butterfly has transparent wings — nearly invisible in plain sight. Software vulnerabilities work the same way. Hiding in codebases for years. Decades, apparently.

The urgency is real. CrowdStrike’s 2026 Global Threat Report found an 89% increase in attacks by adversaries using AI year-over-year. Nation-state actors aren’t waiting for the public release. Anthropic has already documented a Chinese state-sponsored group running a coordinated campaign using Claude Code to infiltrate roughly 30 organizations (tech companies, financial institutions, government agencies) before detection.

Following Fortune’s initial report on Mythos, shares in CrowdStrike, Palo Alto Networks, Zscaler, SentinelOne, Okta, Netskope, and Tenable all slumped between 5% and 11% as investors questioned whether AI-native threat discovery would cannibalize demand for traditional security products. That fear is probably premature. But it signals what the market already knows: the threat model just changed.

“Claude Mythos confirms what we’ve been tracking: AI has crossed a cybersecurity threshold. Capabilities that required nation-state resources are now on a path to anyone with a laptop and a prompt. The time-to-exploit window is collapsing, and security leaders who are still running a patching-first strategy are in a race they can’t win. This is the moment to reassess your foundations — not just your tools, but whether your tools themselves are secure,” says Jonathan Zanger, chief technology officer of Check Point Software Technologies.

He’s right. Wiz estimates it will take roughly 12–18 months before Mythos-class capabilities reach open-source models anyone can run locally, without restrictions. That’s not a comfortable runway for organizations still debating whether to automate patch management.

What this means for AI and data leaders

This isn’t another CISO problem. AI leaders deploying agentic systems — models that write code, query databases, trigger workflows — are building on software that Mythos would shred in an overnight run. The attack surface is no longer at the perimeter but every dependency in your stack, every open-source library your AI coding agent touched.

“The window between a vulnerability being discovered and being exploited by an adversary has collapsed — what once took months now happens in minutes with AI. Claude Mythos Preview demonstrates what is now possible for defenders at scale, and adversaries will inevitably look to exploit the same capabilities. That is not a reason to slow down; it’s a reason to move together, faster. If you want to deploy AI, you need security. That is why CrowdStrike is part of this effort from day one,” says Elia Zaitsev, chief technology officer of CrowdStrike.

The architectural implication matters. Blast radius. If one workload is compromised, how far can an attacker move?

“Anthropic themselves acknowledge that frontier AI capabilities will advance substantially in the coming months. That means the same reasoning power that finds a 27-year-old vulnerability in OpenBSD will soon be available to adversaries looking for the next one. Detection is an arms race with no finish line. The organizations that will be resilient aren’t the ones that find vulnerabilities fastest — they’re the ones that have already limited the blast radius to a single workload. Containment Architecture is how you build security that doesn’t depend on winning an arms race,” says Doug Merritt, chief executive officer of Aviatrix.

Anthropic’s own position is clear-eyed about the bind. The same capabilities that make AI models dangerous in the wrong hands make them invaluable for finding and fixing flaws in important software and for producing new software with far fewer security bugs. There’s no version of this where the capability doesn’t exist. The question is who gets there first.

From that point onwards, we should assume that malicious actors will be able to use AI models to discover and weaponize zero-day vulnerabilities at scale, and also rapidly weaponize n-days within hours of their public disclosure.

So what should AI and data leaders do right now? Stop treating security as a compliance checkbox downstream of your AI deployments that another department (CISO) handles. Audit blast radius before you deploy your next agentic system. Pressure every software partner in your stack on their Glasswing posture. And accept that patching cadences designed for a pre-AI world will not survive this one.

The sandwich story ends with a researcher mildly startled in a park. The sequel won’t be as benign.

Image credit: iStockphoto/SvetaZi