Anthropic's Claude Mythos Found Over 10,000 Security Flaws, Then Got Restricted by the US Government
A powerful AI security tool is quietly reshaping how defenders hunt for software bugs. But its own creators are worried about who else might use it.
Key points
- Anthropic released Claude Mythos, an AI model built for cybersecurity and healthcare, to a select group of partners in April 2023.
- Claude Mythos helped 50 technology partners find more than 10,000 high-severity security flaws across major operating systems and web browsers.
- The model uncovered a security bug that had gone undetected inside OpenBSD, an open-source operating system, for 27 years.
- The US government imposed export controls on Claude Mythos and Claude Fable in June 2023, though those restrictions were lifted within two weeks.
- Anthropic limits who can access Mythos directly, citing fears that cybercriminals could weaponise its capabilities.
Anthropic's new AI model didn't launch with a press conference or a product demo reel. It launched quietly, handed to a small circle of technology partners, and then started finding bugs that had been hiding inside software for decades.
As first reported by ThreatVectr, Claude Mythos, a large language model (the same kind of AI technology that powers chatbots like ChatGPT), arrived in April 2023 under a programme Anthropic called Project Glasswing. The idea: give defenders a head start.
Fifty partner organisations used Mythos to scan major operating systems and web browsers for vulnerabilities, weaknesses in software that attackers can exploit. The model found more than 10,000 critical flaws. One had been sitting undetected inside OpenBSD for 27 years. Mythos can also chain multiple flaws together, spotting attack paths a human researcher might miss by examining each bug in isolation. That's the kind of capability that makes this story matter, and also the reason it worries people.
In June 2023, the US government placed temporary export controls on Mythos and Claude Fable, restricting access outside the country. They were lifted two weeks later, but the episode illustrated a real tension: a tool fast enough to find hidden vulnerabilities is also a tool a criminal could use to exploit them. Andrew Bailey flagged exactly this dynamic when he warned that no single country can handle the risks of powerful AI models alone days after a similar US restriction in July 2026.
Anthropics's answer is a two-tier approach. Claude Fable uses the same underlying technology as Mythos but operates under strict rules that block risky security tasks. If a request trips those rules, Fable hands off to a lighter model called Opus 4.8 instead of refusing outright.
What does this mean for ordinary people?
For most people, the direct effect is invisible, at least for now. Your bank, your phone's operating system, the browser you're reading this in: all contain code that security teams are racing to audit before attackers do. Mythos speeds that race. We reported in July 2026 that Microsoft patched a record 570 security flaws in a single update, crediting AI tools for the volume, so Mythos sits in a broader pattern, not an isolated experiment.
Cisco, one of the companies with early access, has published its Foundry Security Spec, an open-source testing framework other vendors can build on without starting from scratch. That matters because attackers don't wait.
Critics are less convinced the story ends there. Finding bugs is only half the job. Organisations still need the resources to fix them, and no AI model stops a scammer from simply talking their way past your defences.
The tools are improving. The humans using them are the variable worth watching.
