On April 7, 2026, Anthropic formally launched Project Glasswing and simultaneously disclosed some capabilities of its internal advanced model, Claude Mythos Preview. The model scored 83.1% on the CyberGym cybersecurity benchmark, well above Claude Opus 4.6's 66.6%, and was described internally at Anthropic as the "strongest AI to date." The project quickly prompted heightened alert across global financial institutions, with multiple banks and fintech firms holding emergency meetings to assess potential risks. Several media outlets reported that some institutions have paused use of certain AI agent tools and demanded stricter code review and access controls. However, within days the model's capability descriptions were challenged by several independent security organizations and researchers as a serious exaggeration, sparking wide industry debate over the veracity of AI security marketing.
Anthropic stated in its official announcement that Claude Mythos Preview, under the Glasswing framework, had autonomously discovered and reported thousands of high‑risk zero‑day vulnerabilities, including a 27‑year‑old OpenBSD remote crash bug, a 16‑year‑old FFmpeg vulnerability that reportedly evaded five million automated tests, and multiple Linux kernel user‑to‑kernel privilege escalation chains. These capabilities were framed as a milestone for "defensive hacking," and Anthropic emphasized the model is intended for defensive purposes only, saying it has worked with Amazon, Apple, Google, Microsoft, NVIDIA, CrowdStrike and other major companies to shore up critical infrastructure.
Immediate trigger for financial sector alarm
After the announcement, global financial institutions reacted swiftly. Internal documents from several investment and commercial banks indicate Claude Mythos Preview is viewed as a "double‑edged sword": on one hand, it could help institutions preemptively find hidden flaws in their systems; on the other, its powerful autonomous exploitation capabilities could be misused by attackers. Some European banks have placed the model on "high‑risk AI tool" lists, requiring additional security reviews for any AI projects involving core trading systems or customer data. Multiple U.S. financial firms held emergency meetings to discuss whether to pause cooperation with Anthropic until the model's safety boundaries are more transparently verified.
The core of the panic is the model's zero‑day discovery capability. Traditional security tools rely on databases of known vulnerabilities, while Claude Mythos Preview is claimed to autonomously uncover unknown flaws—posing an unprecedented threat to software‑dependent financial institutions. Bloomberg quoted an anonymous bank executive saying, "If this capability falls into the wrong hands, the consequences could be catastrophic."
Allegations of exaggerated marketing: capability claims vs. actual performance
Anthropic's publicity was quickly questioned. Several independent security research groups and open‑source communities, after receiving limited preview access, pointed out apparent overstatement in the official descriptions:
- Benchmark limitations: CyberGym and similar benchmarks primarily test the ability to reproduce known vulnerabilities rather than truly discovering unknown zero‑days. Adversa AI Red Team testing indicated the model's performance on real, previously unknown vulnerabilities is far below the official claims; some "autonomously discovered" issues appear to rely on pattern matches from pretraining data.
- Practical availability is limited: Claude Mythos Preview is currently restricted to Glasswing partners and operates within strict sandboxing and permission controls. External parties cannot independently verify the actual number or severity of the "thousands of zero‑days" reported.
- Marketing strategy questioned: Some analysts argue Anthropic deliberately amplified the model's "strongest AI" image to boost brand influence and attract more enterprise customers. The Information reported that Anthropic had internally described the model as an "internal research tool," but presented it externally as the "strongest AI," indicating a clear narrative gap.
Anthropic has not issued a formal response to the exaggeration allegations, saying only that all capabilities were validated in controlled environments and promising to publish more technical details and a list of fixed vulnerabilities within 90 days.
Industry impact: acceleration of an AI security arms race
The episode has had multiple effects on the global AI and financial sectors:
- Financial institutions: In the short term, AI tool usage policies may tighten, and more "human‑in‑the‑loop" mechanisms could be required. In the long term, demand may grow for in‑house or commercial defensive AI security tools.
- AI vendors: Anthropic's approach further intensifies the industry tension between capability demonstrations and safety responsibility. Firms like OpenAI and Google may be forced to adjust their marketing strategies to avoid similar controversies.
- Open source and regulators: The incident may prompt regulators to accelerate scrutiny of cutting‑edge AI capabilities. The EU AI Act and related U.S. legislation could increase audit requirements for high‑risk models.
- Technical trends: Defensive AI capabilities are emerging as a new track. The cross‑industry cooperation signaled by Project Glasswing suggests AI security may shift from passive defenses to proactive, intelligent countermeasures.
Conclusion: balancing publicity and responsibility
The release of Claude Mythos Preview demonstrates Anthropic's ambition at the AI frontier but also exposes tensions in contemporary AI marketing between capability claims and independent verification. The financial sector's alarm is a reminder that as AI capabilities scale rapidly, safety boundaries must be reinforced in parallel. Whether Anthropic can address the exaggeration concerns through transparent follow‑up reports and rigorous governance will directly affect its credibility in the enterprise AI market.
At a pivotal moment when AI moves from the lab into critical infrastructure, balancing technological breakthroughs with responsibility has become a shared challenge for all AI vendors. The Claude Mythos Preview episode may become a notable case in this transition, prompting the industry to establish stricter and more transparent capability disclosure practices.
▶️ Enjoy this piece? Content creation is hard!
Follow our YouTube channel:
AI Rosetta
Your likes, subscriptions and shares are our greatest support! 🙏
More AI news at: https://www.airosetta.com