Anthropic's Mythos Model Exposes Who Decides Which Infrastructure Gets Defended First

Anthropic restricted its Claude Mythos Preview model to roughly 50 organizations under Project Glasswing, citing its dangerous capability at finding and weaponizing software vulnerabilities. The highlight reel is striking: thousands of bugs surfaced across major OSes and browsers, a 27-year-old OpenBSD flaw, and 181 working exploits chained from Firefox vulnerabilities versus just two from the prior flagship. But the public has no way to evaluate the decision because the unfiltered output, false-positive rate, and non-working-exploit rate were never disclosed. A model that hallucinates plausible bugs in patched code is a very different operational object than one that finds real ones with surgical precision.

The access list also encodes a blind spot. LLMs perform best on what they were trained on — mainstream open source, big browsers, the Linux kernel — which is exactly the software the chosen vendors ship. Industrial control systems, medical device firmware, regional banking stacks, and older embedded code sit outside that distribution. Anthropic’s engineers cannot audit those domains, but a motivated attacker with domain expertise can use Mythos as a force multiplier against them. Fifty hand-picked companies cannot substitute for the distributed expertise of academic researchers, control-systems engineers, and specialists in less prominent ecosystems.

Schneier and Lie argue this is structurally untenable: a private startup is unilaterally deciding which pieces of critical global infrastructure get defended first. OpenAI’s GPT-5.4-Cyber is following the same pattern, and Aisle reportedly reproduced many of Anthropic’s published results with smaller public models, so Mythos is unlikely to remain unique. Regulation will eventually arrive, but the immediate ask is transparency — coordinated independent auditing, mandatory disclosure of aggregate performance metrics, and funded access for academic and civil-society researchers — so the choice of who gets defended is not made inside one company’s boardroom.