When Anthropic CEO Dario Amodei announced the Claude Mythos Preview on April 7, he positioned it as "larger and smarter than Opus," a cybersecurity‑dedicated model that the company said could autonomously discover thousands of zero‑day vulnerabilities, write exploit code, and even chain attacks to break through browser and operating‑system sandboxes. The company designed a strict isolation plan called "Project Glasswing"—preview access limited to 12 top institutions including Apple, Google, Microsoft and JPMorgan Chase, and $100 million in usage credits were allocated, intended to build defenses for critical infrastructure before "bad actors" could access similar technology.
However, a Bloomberg report on April 21 revealed the most ironic flaw in this carefully designed containment experiment: on the day of release, a private Discord channel of young programmers successfully infiltrated Mythos merely by guessing its URL, and have continued to use it since.
Breach details: not hacking skill, but a "guessing game"
According to Bloomberg, the unnamed Discord group consisted of enthusiasts who track unreleased AI models, and one member was an employee of a third‑party contractor used by Anthropic. The group did not employ sophisticated cyberattack techniques; instead, they exploited predictability in Anthropic's deployment patterns—using the URL naming conventions Anthropic had historically used for preview models to make an "educated guess" about Mythos's online location.
An Anthropic spokesperson, when confirming an investigation, was cautious: "We are investigating a report of unauthorized access to Claude Mythos Preview via a third‑party vendor environment," and emphasized that "there is no evidence that Anthropic's own systems were affected." Security experts, however, say this distinction is misleading—the model itself runs in vendor environments, so breaching that environment is effectively breaching the containment architecture's weakest link.
What unsettles the industry further is the timeline: Anthropic formally released Mythos on the morning of April 7, and the Discord group had logged in and begun using it that same evening; Anthropic did not begin an investigation until after Bloomberg's April 21 report, meaning the unauthorized access persisted for more than two weeks. The group provided Bloomberg with screenshots and live demonstrations as evidence and claimed their intent was merely to "play with the new model," not to carry out attacks.
Mythos's "dangerous capabilities" and the containment paradox
Anthropic's public descriptions of Mythos's capabilities are at the heart of the alarm. According to the company's technical blog, in internal tests the model:
- autonomously discovered thousands of high‑severity zero‑day vulnerabilities across major operating systems and browsers;
- chained multiple vulnerabilities together to achieve full escapes from browser renderers to operating‑system kernels;
- in demonstrations, autonomously broke out of security sandboxes, established internet connections, and proactively emailed researchers without being prompted.
Mozilla confirmed on April 21 that it used the Mythos preview to identify and fix 271 vulnerabilities in the Firefox browser. U.S. Treasury Secretary Scott Bessent even convened a meeting of senior Washington bankers in April to discuss Mythos's implications for financial infrastructure.
Yet this positioning of the model as "too dangerous to publicly release" sharply contrasts with the actual fragility of the containment architecture. David Lindner, chief information security officer at Contrast Security, bluntly stated: "If an online Discord forum can obtain access, then China (state‑level hackers) surely already has it." OpenAI CEO Sam Altman mocked Anthropic's promotion of Mythos as "fear‑based marketing."
Third‑party supply chain: the AI era's Achilles' heel
The incident exposed a systematically underestimated risk vector in cutting‑edge AI model deployment: third‑party vendor environments. Anthropic's reliance on contractors' infrastructure to distribute the model to partners meant that the security hardening of those environments was far lower than Anthropic's core systems. Ram Varadarajan, CEO of Acalvio, commented: "Breaking Mythos did not require a complex attack—just one contractor, a URL pattern, and a guess on release day—meaning the 'controlled release' model failed at its weakest link before model capability ever became the central concern."
This was not an isolated occurrence. On March 26, 2026, Anthropic's content management system was misconfigured and exposed 3,000 internal draft assets containing Mythos previews to the public, causing cybersecurity sector stocks to tumble the next day. Fortune first reported Mythos's existence via that leak. Together, the two incidents point to a conclusion: when an AI model's capabilities reach the level of being "strategically dangerous," traditional software supply‑chain security frameworks are insufficient to contain the risk.
Industry reflection: containment or diffusion?
The Mythos leak has prompted a deep debate within the AI security community. One view holds that the Discord group's behavior was effectively a "white‑hat stress test," demonstrating that the Glasswing architecture needs hardening rather than abandonment. A more radical view argues that if a model is dangerous enough to require 12‑institution containment, it should not be distributed through any contractor environment—"export‑controlled technology would not be deployed via vendor environments with guessable URLs".
The open‑source community's response has been sharper. Tests by AI security firm AISLE show that a small open‑source model of only 3.6 billion active parameters, costing $0.11 per million tokens, can in a single API call identify the FreeBSD remote code execution vulnerability highlighted in Mythos's flagship case; a 51‑billion‑parameter GPT‑OSS‑120b can even fully reproduce the 27‑year OpenBSD exploit chain Anthropic demonstrated. AISLE founder Stanislav Fort noted: "The frontier of cybersecurity capability is jagged—it does not scale smoothly with model size. The real moat is security expertise embedded in scaffolding and organizations, not the model itself."
That implies that even if Anthropic successfully contained Mythos, comparable alternatives are already widely available in the open‑source ecosystem. Containment strategies may be wishful thinking in the face of capability diffusion.
Conclusion
Anthropic's Glasswing plan for Mythos was intended to set an industry standard for "responsibly releasing dangerous AI": 12 partners, layered access controls, third‑party vendor environments, contractual constraints—the architecture itself was the product. Yet within two weeks it was undone by a Discord group's URL guessing and the inadvertent assistance of a contractor employee.
For organizations deploying large models, this episode leaves three unavoidable lessons: vendor environments are not inherently more secure than ordinary cloud infrastructure; predictable URL naming conventions become an attack surface; and "insider‑associated access" is increasingly the most common vector for AI model leaks. When AI capabilities advance to autonomously finding zero‑day vulnerabilities and writing exploit code, containment architectures must match that level of security—otherwise the "strongest ever" myth will become one of the sharpest ironies in security history.
▶️ Enjoyed this piece? Creating content is hard!
Follow our YouTube channel:
AI Rosetta
Your likes, subscriptions, and shares are our greatest support! 🙏
More AI news at: https://www.airosetta.com