Anthropic's Mythos 1: Power, Leaks, and Mixed

On Friday, Anthropic said Mythos would stay locked down. It needed stronger safeguards. Public release wasn't happening anytime soon.

On Saturday, users started finding references to "Claude Mythos 1" and "Claude Mythos 1 preview" embedded in the source code of Claude Code and Claude Security.

That's a 24-hour turnaround on a position Anthropic had just publicly staked out. Either the company's safety calculus shifted overnight in ways they haven't explained, or the rollout was already in motion when they made the statement. Neither is a great look—but both are worth understanding before you decide what to make of it.

What Mythos Actually Did

The best way to grasp why this matters is to sit with the Project Glasswing numbers for a moment. In 30 days, Mythos scanned roughly 1,000 core open-source projects and surfaced 23,019 total vulnerabilities, of which 6,202 were assessed as high or critical severity. Six independent security firms manually verified the findings. The AI's true positive rate came out to 90.6%—lower false-positive rates, the video notes, than you'd typically get from top human security testers.

Some specific results are hard to shrug off. Cloudflare found 2,000 vulnerabilities in their core system pathways, 400 of them high or critical. Mozilla patched Firefox 150 for 271 critical vulnerabilities at once—more than ten times what was found in Firefox 148 using an older model. OpenBSD had a 27-year-old bug sitting in their codebase; Mythos found it and, without human assistance, constructed a working exploit chain around it.

The UK AI Safety Institute officially confirmed that Mythos preview is "the first AI model in the world capable of fully defeating their dual network challenge end to end." One beta tester, describing the experience on X, said it felt like "watching an F-22 fighter jet fly overhead while holding a spear."

There's also the WolfSSL case, which cuts closer to daily life than most of this. WolfSSL is a cryptography library running on billions of IoT devices, routers, and smart cars. Mythos didn't just find a vulnerability there—it wrote functional attack code capable of forging digital certificates, the kind that would let someone build a convincing fake bank website indistinguishable from the real thing. The vulnerability was caught and fixed. But the demonstration of what the model can independently produce is the part worth holding onto.

The Bottleneck Nobody Planned For

Here's a structural problem that Anthropic apparently didn't fully anticipate: finding vulnerabilities fast is only useful if humans can fix them at comparable speed. They can't.

Of 1,129 vulnerabilities Anthropic submitted to open-source maintainers, only 75 had been patched as of this reporting. The average human programmer takes about two weeks to fix a single high-severity vulnerability, even with a detailed report in hand. Several maintainers reportedly sent Anthropic emails asking them to slow down because the volume was simply overwhelming.

This isn't really a criticism of Anthropic—it's a systemic mismatch that was always going to emerge once AI vulnerability discovery scaled up. The patch cycle was never designed for this throughput. Anthropic's decision not to release Mythos publicly starts to look less like caution about offensive use and more like a recognition that the defensive infrastructure isn't ready either.

Their response has been to build it. Claude Security, the new enterprise tool, doesn't just surface vulnerabilities—it generates fix patches. Enterprise customers have used it to resolve over 2,100 vulnerabilities in its first three weeks. Anthropic also open-sourced a bug-finding pipeline, an automation framework for parallel codebase scanning, and a threat model builder. Cisco announced a complementary open-source project called the Foundry Security Spec System. The vision is a loop where AI detects, AI patches, and humans only touch the final review.

Whether that loop works at scale—and who has access to it—is the live question.

The Rollout That Wasn't Supposed to Happen Yet

The source code sightings of Mythos 1 in Claude Code and Claude Security are interesting not just because they contradict Friday's statement, but because of where they appeared. These aren't consumer-facing products. Claude Code is a developer tool; Claude Security is the enterprise vulnerability management dashboard Anthropic has been building out as a direct competitor to platforms like Snyk and Veracode.

So if Mythos 1 is being integrated anywhere, it's being integrated somewhere gated—enterprise contracts, API access controls, the kind of environment where you theoretically know who's using it. That's a different risk profile than a public API, and it might explain how Anthropic could move quickly without (in their view) violating their own stated conditions. The leaked signals don't tell us which interpretation is right—they just tell us the integration is happening faster than the public messaging suggested.

Rumors of Claude Opus 4.8 already in internal evaluation at select partners add another layer. If that launches in coming weeks, it would fit Anthropic's recent release cadence and align with the infrastructure moves they're making. At some point, "building toward a rollout" and "rolling out" become the same sentence.

Two Anthropics in the Same Week

The most revealing thing about this week wasn't the code leak—it was the juxtaposition of two events.

On Wednesday in London, Anthropic held "Code with Claude," a developer-focused event built around the theme of productivity and magic. Boris Cherny, who created Claude Code, talked about reconnecting with the feeling that drew him into programming. Developers got free lunches and complimentary mini computers. When someone asked how many people in the crowd had shipped Claude-written code without reading it first, a startling number of hands went up.

On Thursday at Oxford, Anthropic co-founder Jack Clark gave a lecture in a noticeably different register. He said AI posed "a non-zero chance of killing everybody on the planet." He predicted recursive self-improvement—AI improving itself without human intervention—by 2028 or sooner. He said most of the world is in denial about current capabilities, "let alone what's coming in 6 months." And he offered this about Mythos specifically: "When Mythos finished training, they were like, oh, it's here faster than we thought, and we've done insufficient preparation."

That admission is worth dwelling on. Anthropic, a company that positions safety as its founding premise, is acknowledging that its own most powerful model arrived ahead of its own timeline, with its own leadership feeling underprepared.

None of this is necessarily dishonest. Companies do tailor messages to different audiences—London developers want to hear about productivity, Oxford academics want the honest risk assessment. But these two events happening within 48 hours of each other, in the same week that source code references surfaced in production tools, creates a specific kind of cognitive dissonance.

The Financial Picture (Such As It Is)

Layered under all of this is a financial story that's harder to read cleanly. The Wall Street Journal reported Anthropic is approaching its first profitable quarter, projecting an operating profit of $559 million on revenue that reportedly more than doubles from Q1 to Q2. Tech journalist Ed Zitron has scrutinized these numbers closely, noting that the WSJ itself acknowledged uncertainty about which accounting methods Anthropic used—the company isn't subject to public reporting standards yet.

The mechanism for the profitability claim also requires context: Anthropic signed a deal to take over SpaceX's Colossus compute clusters, and per sworn SpaceX filings, Anthropic's monthly fees are discounted during the ramp-up period—which happens to be Q2, the quarter Anthropic is using to claim its profitability milestone. Suppressed compute costs during a specific window, combined with possible front-loading of enterprise token prepayments, gives you a number that might be technically accurate and structurally misleading at the same time. The company has also acknowledged it may not remain profitable once full spending resumes.

None of this is unusual in the AI industry—everyone is operating with some combination of creative accounting, deferred costs, and investor optics. But it matters for the Mythos story because it frames the competitive pressure Anthropic is operating under. Building the best model in the world and keeping it on the shelf is expensive. Building enterprise security products and moving fast is how you pay for the next model.

The Hire That Signals Intent

Adding to the picture: Anthropic this week hired Andrej Karpathy, co-founder of OpenAI and former head of Tesla Autopilot's computer vision team, to work on its pre-training team. This follows Ross Nordeen—founding XAI member and ex-Tesla employee—who announced earlier this month he'd also joined Anthropic. You don't recruit at that level to maintain your current trajectory.

Mythos demonstrated capabilities that Anthropic itself apparently didn't fully anticipate. Their stated safety conditions for public release haven't been publicly met—or publicly revised. The infrastructure for a broader rollout is being built in real time. And the company is simultaneously telling developers it's magic and telling academics it might be dangerous.

The question isn't whether Anthropic believes both things. They probably do. The question is whether those two beliefs can coexist in the same product decisions for much longer.