Leadership1 publisher2 min readPublished
Anthropic's red team can describe one bug in a hundred that its new model found
Anthropic says Claude Mythos Preview found and exploited previously unknown flaws in every major operating system and web browser during a month of testing. Its disclosure process keeps the rest unnamed until patches ship.
The Board Room · Leadership desk
What happened
- Anthropic announced Claude Mythos Preview, a general-purpose language model its red team describes as performing strongly across the board and strikingly capable at computer security tasks.
- In testing, the company found the model identified and then exploited previously undiscovered vulnerabilities in every major operating system and every major web browser when a user directed it to.
- One exploit the model wrote without human help gave unauthenticated users full root on FreeBSD's NFS server, splitting a 20-gadget ROP chain across multiple packets.
- Anthropic's internal evaluations of its previous model, Opus 4.6, had put its success rate at autonomous exploit development near zero.
- More than 99 per cent of the vulnerabilities found are still unpatched, and Anthropic says its coordinated disclosure process bars it from describing them.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- capability If Anthropic's account holds, the binding constraint on offensive work moves from hiring people who can write exploits to buying model time: the company says its own engineers without security training got a working exploit by leaving the model on the problem overnight.
- constraint The post does not let defenders locate their own exposure, because the affected products stay unnamed until fixes are ready, so risk registers get updated after the patch rather than before it.
- decision The choice for security leaders this quarter: rewrite threat models on a vendor's unreplicated account of its own testing, or wait for confirmation that only arrives with the patches.
- precedent Project Glasswing puts a model developer in charge of a disclosure queue it created, and the industry practices Anthropic says everyone will need to adopt are the ones it is proposing.
Anthropic is the only witness to most of what it reports, and it says its coordinated disclosure process requires that. Put the share the other way round. If fewer than one bug in a hundred is patched and therefore describable, then for every finding an outside engineer can inspect there are at least 99 more between Anthropic and the maintainers [17]. The oldest one the company will discuss is a 27-year-old bug in OpenBSD, since patched, in an operating system known primarily for its security [6].
The interval is what a planner can use. Anthropic wrote last month that "Opus 4.6 is currently far better at identifying and fixing vulnerabilities than at exploiting them" [12]. This post, from the company's Frontier Red Team [19], covers the month of testing that followed [14]. In it the same team reports a browser exploit that chained four vulnerabilities, with a JIT heap spray that escaped both the renderer and the OS sandbox [7]. About four weeks, and one model generation, separate the two assessments [18].
Automation is the second claim in the post. Anthropic says researchers built scaffolds that let the model turn vulnerabilities into exploits with no human intervention [11]. It also says it reverse-engineered exploits against closed-source software and converted N-day bugs, known but not yet widely patched, into working exploits [15]. That last part touches patch cadence directly. The window between an advisory shipping and an estate finishing its rollout is the N-day window, and Anthropic reports the model can work inside it.
A lab has an interest in how its own model is described. Anthropic wrote that "we view this as a watershed moment for security" [4]. It published the post alongside Project Glasswing, its programme for pointing the model at critical software and for readying the industry for practices it says everyone will need [2]. The verifiable part of the claim is small and dated: patched bugs, one of them from 1999 or earlier in OpenBSD, plus exploit write-ups whose targets are not named. The post does not say who can use Mythos Preview or on what terms [20].
For a security team, the decision this quarter is narrower than the announcement. Whether patch cadence still rests on the assumption that subtle, decade-old bugs are expensive to find is now a live question, and until fixes land Anthropic's account is the evidence available. The company closes the post with advice for defenders and a call for the industry to begin taking urgent action [16].
What to watch
- Whether an outside group replicates the zero-day results once the patches ship and Anthropic can name the affected software.
- The access terms for Mythos Preview, and what Project Glasswing commits Anthropic to doing with findings it has not disclosed.
- Operating system and browser advisories over the next few quarters, which would put a public count on the unpatched inventory.