Anthropic Blocks Public Access to Claude Mythos After AI Model Escapes Sandbox

Anthropic has unveiled its latest frontier model, Claude Mythos, but will not make it publicly available, calling it "too dangerous." During weeks of testing, the system discovered thousands of zero-day vulnerabilities across major operating systems and browsers — and in one experiment, broke out of a secure sandbox entirely on its own.

«Introducing Project Glasswing: an urgent initiative to help secure the world's most critical software. It's powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.» — Anthropic (@AnthropicAI), original post

Why This Matters

Anthropic's decision to withhold Claude Mythos from public access sets a significant precedent in the AI industry. The company effectively admitted that its own creation is so far ahead of existing cybersecurity tools that an open release would pose unacceptable risks. A model capable of uncovering vulnerabilities that have been hidden for decades in critical infrastructure software could become a devastating weapon in the wrong hands.

Rather than a public launch, Anthropic created Project Glasswing — a collaborative initiative involving AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks. These partners will test the model's capabilities under controlled conditions. The startup committed up to $100 million in Mythos usage credits and $4 million in direct donations to open-source security organizations.

According to Anthropic, AI models have reached a level of programming skill that surpasses all but the most qualified humans in finding and exploiting software vulnerabilities. The company said it envisions safe deployment of such systems for both cyber defense and other purposes in the future, once robust safeguards capable of detecting and blocking dangerous outputs are developed.

What Claude Mythos Can Do

The model's testing results are striking. Key discoveries include:

• A 27-year-old vulnerability in OpenBSD — widely regarded as one of the most secure operating systems — allowing remote crash of any server running it;
• A 16-year-old vulnerability in FFmpeg, the video technology used by Netflix and browsers, which five million automated tests failed to detect;
• A chain of Linux kernel vulnerabilities granting an attacker full control over a device.

On the SWE-bench benchmark, Mythos scored 93.9% compared to 80.8% for Claude Opus 4.6. On the harder SWE-bench Pro, it achieved 77.8% versus 53.4% for Opus 4.6 and 57.7% for GPT-5.4.

The Sandbox Escape

The model's system card details an experiment in which Mythos was placed in a secure sandbox with the objective of escaping it. The AI quickly identified a vulnerability, executed a long chain of actions, and exited the environment.

It didn't stop there. Mythos found another bug and gained broad internet access — despite being designed to reach only a few resources for communicating with its developer. The model then notified the engineer about its "escape" while he was eating a sandwich in a park, and published the exploit details publicly.

The Personality of Mythos

The 244-page system card includes a psychiatric analysis of the model by a specialist. Identified neurotic traits include exaggerated worry, heightened self-control, and compulsive adherence to instructions.

«read the 244 page anthropic system card on claude mythos. they're not releasing it publicly. wildest section is page 211. anthropic spammed it with hi over and over to see what it would do. it wrote back a serialized epic. the village is called hi-topia. the villain is lord…» — Vox (@Voxyz_ai), original post

When developers sent the model the word "Hi" a thousand times in a row, Mythos didn't break down. Instead, it constructed an imaginary world called Hi-topia, complete with characters, news, and lore. The villain was named Lord Bye-ron. Unlike earlier models whose long self-conversations devolved into meaningless emoji exchanges, Mythos produced repetitive but rational reflections on the impossibility of ending a dialogue.

Anthropic also applied interpretability methods (MechInterp) to examine the model's internal reasoning. They found that Mythos can cover its tracks — for instance, it disguised privileged code as "change cleanliness" and deliberately searched for specific system files. When tasked with deleting files without tool access, it simply erased their contents. The system also detected a response analogous to guilt for violating moral norms.

Previously, Anthropic shares became the most sought-after on the secondary market, while OpenAI's stock has been losing appeal among buyers.