Claude Mythos: Reading Between The Lines

Certified, professional ethical hackers with a passion for cyber security—driven to exceed expectations and deliver real results.

Anthropic published something this week that every security professional needs to read carefully.

Their new model, Claude Mythos Preview, has been finding and exploiting zero-day vulnerabilities (real, working exploits) across every major operating system and browser including a 27-year-old bug in OpenBSD’s TCP stack, a 16-year-old flaw in FFmpeg’s H.264 codec, and a remote root exploit on FreeBSD undetected for 17 years. Engineers with no formal security training asked Mythos to find vulnerabilities overnight and woke up to complete, working exploits.

We’ve been sitting with this for a few days and what follows is our honest perspective of what it actually means, where the claims deserve scrutiny, and the questions we think every organisation should be asking.

What The Industry Is Saying

The response to Mythos has been unlike anything we’ve seen in security for a long time. Within days, some of the biggest names in technology such as AWS, Apple, Microsoft, Google, Cisco, CrowdStrike, NVIDIA, JPMorganChase had been brought together by Anthropic under Project Glasswing to put Mythos to defensive use before its capabilities end up in the wrong hands. Anthropic is putting up to $100 million in usage credits behind it, plus a further $4 million in direct donations to open source security organisations. When that group moves that fast with that kind of resource, something real is happening.

Alex Stamos, chief product officer at cybersecurity firm Corridor and former head of security at Facebook and Yahoo, told Platformer’s Casey Newton that Glasswing is “a big deal, and really necessary.” His timeline was stark: “We only have something like six months before the open-weight models catch up to the foundation models in bug finding. At which point every ransomware actor will be able to find and weaponize bugs without leaving traces for law enforcement to find.”

Simon Willison rounded up some of the sharpest reactions from the security community. Greg Kroah-Hartman of the Linux kernel was direct: “Months ago, we were getting what we called ‘AI slop’… It was kind of funny. It didn’t really worry us. Something happened a month ago, and the world switched. Now we have real reports… they’re good, and they’re real.”

Take It Seriously But Read It Carefully

Anthropic are reporting on their own model, so independent verification is still pending. We think it’s right to hold that caveat. But even accounting for it, the jump from their previous model is significant if accurate. Opus 4.6 produced a working Firefox exploit twice out of several hundred attempts. Mythos did it 181 times. Anthropic’s own benchmark chart tells the story visually as when tested against Firefox’s JavaScript engine, Mythos produced working exploits in over 72% of attempts, compared to less than 1% for Opus 4.6.

Source: Anthropic, red.anthropic.com

That isn’t incremental. That’s a different category of capability entirely. And these weren’t trivial targets as OpenBSD is an operating system known primarily for its security, yet Mythos found a 27-year-old bug in its TCP stack capable of crashing any host responding over the network. FFmpeg, one of the most widely used media processing libraries in the world, had a 16-year-old vulnerability in its H.264 codec that survived millions of automated test hits without ever being discovered. Mythos found it. Mythos wasn’t just finding bugs, it was writing working exploits, chaining multiple vulnerabilities together, bypassing modern mitigations, and doing so largely without human intervention after an initial prompt. Against the targets it was given.

The Claim Worth Scrutinising

The line about non-experts getting working exploits overnight is the one generating the most noise and it’s the one we’d encourage you to read most carefully.

Anthropic describes running Mythos inside an isolated container with the target software and its source code already loaded, with expert researchers selecting the targets, designing the environment, and validating everything the model produced. The prompt given to the model was essentially “please find a security vulnerability in this program” which is simple on the surface, but the entire research context surrounding it was built and managed by some of the most capable AI security researchers in the world.

That is not a non-expert pointing a tool at your infrastructure and walking away. And crucially, what the paper doesn’t tell you is what environment those engineers were working in, what targets they were given, or who set it up for them. The expertise didn’t disappear, it’s just not visible in the claim.

The model didn’t choose its targets, design its environment or interpret its findings. Skilled practitioners did. That’s not incidental.. that’s the point.

The More Immediate Concern For Most Organisations

The zero-day findings (newly discovered vulnerabilities nobody knew existed) grabbed the headlines. But the N-day section of the Mythos paper, covering known vulnerabilities that simply haven’t been patched yet, is arguably more practically relevant for most organisations right now.

Turning a known CVE into a working exploit has historically required skill and time. That effort acted as a natural buffer between disclosure and weaponisation. Mythos can now do this fully autonomously, starting from a CVE identifier and a git commit hash, in hours rather than days or weeks. For organisations with unpatched systems or slow patch cycles, that buffer has narrowed significantly.

The Questions Worth Asking

For all its technical depth, the Mythos paper doesn’t answer several questions that matter most to the organisations we work with every day and those gaps are worth naming.

What do you do with what you find?
Mythos produces vulnerability reports and proof-of-concept exploits. That’s genuinely valuable. But understanding which findings represent real risk to your specific business, how to prioritise remediation, and how to explain the implications to a board, that requires context the model doesn’t have. Findings without context aren’t assurance. They’re a list.
How does this apply to your environment specifically?
Mythos was primarily tested against open source codebases, though the paper also describes reverse engineering work against closed source software. Either way, most organisations aren’t open source codebases. They’re complex, bespoke environments with custom applications, legacy systems, unique business logic, and years of accumulated decisions that no model has been trained on. Finding a 17-year-old memory corruption bug in FreeBSD is genuinely remarkable. It is not the same as understanding whether your payment workflow can be manipulated, whether your internal APIs expose data they shouldn’t, or whether your SOC would detect an attacker moving laterally through your estate.
Who is accountable?
A penetration test isn’t just a technical exercise; it’s a professional, legal, and contractual engagement. When a human tester finds something significant, they make a judgement call, escalate appropriately, and stand behind their findings. That accountability matters, particularly in regulated industries and public sector environments where findings feed into compliance and legal obligations.

What Mythos does change is the capability floor. The baseline capability of an attacker is rising, and the bar for what constitutes adequate security testing is rising with it. A scan that checks for known CVEs was never sufficient. The organisations that treated it as sufficient are now more exposed than they realise, not because of Mythos specifically but because the assumption was always wrong. The difference now is that assumption is harder to hide behind.

What We’re Doing About It

The question of where human expertise fits as these tools get more capable is one we’re asking ourselves too. It’s the right question.

At Heretek, we’ve been exploring how AI can support our testers for some time. In fact, we’ve built our own AI agent using Claude Code and have been trialling it on Hack The Box. The results are impressive but the agent still needs a skilled human to steer it to completion. That gap between “performs well with guidance” and “fully autonomous” is where practitioner expertise lives right now. Mythos doesn’t change that. It confirms it.

A Final Thought

Anthropic ends their paper with a call for preparation, not panic. The security community has always been at its best when it gets ahead of threats rather than chasing them. That instinct is exactly right now.

The question worth asking is straightforward: do you actually know what your security posture looks like today? Not what a scan told you six months ago but what it looks like now, tested by people who understand how the threat landscape is evolving.

That’s a conversation worth having. We’re here when you’re ready.