What is Claude Mythos?

A general-purpose frontier model from Anthropic, introduced on 2026-04-07, that is strikingly strong at multi-step cybersecurity work, finding software vulnerabilities at a level that surprised the industry. Its distinctive feature is not raw capability but that capability paired with a deliberately restricted release. We describe it as a landscape entry, not a tool we run.

Can I use Mythos in production?

Almost certainly not. Mythos is gated: Anthropic did not release it publicly and access is limited to vetted Project Glasswing participants, defensive security teams, critical industry partners and open-source maintainers who meet security requirements. There is no public API for the general developer. For the overwhelming majority of teams the realistic relationship is to understand it, not to use it.

What is Project Glasswing?

Anthropic's vetted consortium and access programme for Claude Mythos, formed around the model's cybersecurity capability. It grants access to defenders, critical industry partners and open-source maintainers who clear security requirements, and gates the general public out. The intent is to put a frontier vulnerability-finding capability in defenders' hands before attackers reach equivalent power.

Why does Mythos get its own page when Haiku does not?

Because a model earns a page only when it has a distinctive, defensible story, not when it merely posts a good benchmark. A mid-tier or small model is a catalogue entry: you pick a tier, read a row, and move on. Mythos changes how you think about the landscape, a frontier security capability behind a novel gated-access model the whole industry is reacting to. That is the page-worthiness criterion, and Mythos is its clearest example.

Is it safe to publish a model this capable at security?

It is genuinely debated, and we keep it balanced. The case for the gated release: a vulnerability-finding capability is dual-use, so giving defenders a head start to find and patch flaws before attackers reach equivalent capability can shift the balance toward defence, this is the responsible-disclosure argument at scale. The concern: it concentrates a powerful dual-use capability behind one vendor's gate, and the transition is risky. Reasonable people land on both sides; the honest position is to hold the tension rather than resolve it cheaply.

← Stack

Claude Mythos

A frontier model that is page-worthy: exceptional at security, deliberately gated, and a case study in when a model earns its own page.

Overview

Claude Mythos is a general-purpose frontier model from Anthropic, introduced on 2026-04-07. What makes it distinctive is not that it is large or capable in general, plenty of models are: it is strikingly strong at multi-step cybersecurity work, finding software vulnerabilities that had eluded human reviewers for years. Anthropic reports it found high-severity flaws in every major operating system and web browser during testing. An independent evaluation by the UK AI Safety Institute reported it succeeds on roughly 73% of expert-level capture-the-flag tasks, a class of challenge no model could complete before April 2025. We report these figures as published by Anthropic and AISI, not as our own measurement: this is a model we map, not one we run.

Anthropic did not release Mythos publicly. Citing dual-use risk, a tool this good at finding vulnerabilities helps attackers as much as defenders, it gated access through Project Glasswing: a vetted consortium of defenders, critical industry partners (operating system and browser vendors, financial institutions) and open-source maintainers, each meeting security requirements before access. The general public is gated out by design. The bet is that giving defenders a head start to find and patch flaws before attackers gain equivalent capability shifts the balance toward defence. That bet is debated, and we keep the debate balanced on this page rather than taking a side.

So why does Mythos get its own page when a workhorse or a small model does not? Because page-worthiness is about a distinctive, defensible story, not capability alone. Most models are catalogue entries: you pick a tier, read a benchmark row, and move on. Mythos is different on an axis that matters beyond raw scores: a frontier security capability paired with a novel access model that the whole industry is reacting to. That combination is the story, and it is the reason this page exists. Treat it as the exemplar of the rule: a model earns a page when it changes how you think about the landscape, not when it merely posts a good number.

Architecture

The interesting structure here is not the model internals, which Anthropic has not disclosed, but the access model around it. Project Glasswing is a gate: Claude Mythos sits behind a verification step, and only vetted lanes reach it, defensive security teams, critical industry partners, and open-source maintainers, each cleared against security requirements. The general public is gated out by design. Read the diagram as a map of who can reach the model and on what terms, which is the part of Mythos that is actually novel and the part that matters for the landscape.

The Project Glasswing access model: vetted defenders, critical partners and open-source maintainers reach Claude Mythos through a verification gate; the general public is gated out.

Key concepts

Frontier model: The most capable tier of models a lab ships: the largest and best at the hardest reasoning, at the highest cost and latency per call. Mythos is a frontier model, distinctive for its security capability rather than for being frontier per se.
Gated / restricted release: A model that is not made generally available: access is granted only to vetted parties under conditions, rather than sold to anyone via a public API. Mythos is gated, which is why most teams cannot call it at all.
Project Glasswing: Anthropic's vetted consortium and access programme for Claude Mythos, formed around its cybersecurity capability. It admits defenders, critical industry partners and open-source maintainers who meet security requirements, and exists to put the model in defenders' hands first.
Dual-use capability: A capability that helps defenders and attackers alike. Finding software vulnerabilities is dual-use: the same skill that lets a defender patch a flaw lets an attacker exploit it. Dual-use risk is the stated reason Mythos is gated.
Responsible disclosure: The practice of reporting a discovered vulnerability privately to the vendor so it can be patched before details are made public. The Glasswing model leans on it: defenders find flaws with Mythos and get them fixed quietly rather than published.
CTF (capture the flag): A security challenge format where a solver must reach a hidden token by working through a controlled, deliberately vulnerable system. Used as a capability benchmark: AISI reported Mythos solves a high share of expert-level CTF tasks, with the caveat that ranges lack real-world defenders.
Red-teaming: Probing a system or a model for weaknesses by simulating an adversary, in order to fix them. A defensive practice: the point of red-teaming Mythos-class capability is to understand and contain its risks before they reach the wider world.

When to use

Good fit

Defensive security teams at scale. The whole point of Mythos under Project Glasswing is to put a frontier vulnerability-finding capability in the hands of defenders first: large security organisations that can find and patch flaws across their own codebases before attackers reach equivalent capability. If you run defensive security for critical software, this is who the access model is built for.
Vulnerability-research partners and critical-infrastructure vendors. Operating system and browser makers, financial institutions and similar partners who maintain software the wider internet depends on are the consortium Mythos was gated to. Mozilla, for instance, reported finding and patching 271 Firefox vulnerabilities in a single evaluation pass using Mythos Preview. The fit is hardening software that millions rely on.
Vetted open-source maintainers. Anthropic admitted open-source maintainers to the access programme so that widely used dependencies, the libraries everything else is built on, can be hardened too. If you maintain critical open-source infrastructure and meet the security requirements, the access model includes you.
Most teams: not a fit, and that is the honest answer. Mythos is gated, so for the overwhelming majority of teams the realistic relationship to this model is to understand it, not to use it. Knowing it exists, what it signals about AI-assisted security, and why it is restricted matters for how you reason about the landscape, even though you will not be calling it.

Anti-patterns

Assuming you can call Mythos like a normal API. There is no public endpoint: it is gated to vetted Project Glasswing participants. Architecting a product around access you do not have is a dead end. If your design needs Mythos specifically, the design is wrong for almost every team.
Treating a gated frontier capability as a commodity. Mythos is not interchangeable with a workhorse model you can swap in. Its access terms are part of what it is. Reasoning about it as if it were just another row in a benchmark table misses the only thing that makes it notable: a distinctive capability behind a deliberate gate.
Reading the reported benchmark figures as a promise about your systems. AISI itself cautioned that its evaluation ranges lack active defenders and defensive tooling, so a high capture-the-flag score does not mean the model would walk through a well-defended real network. Take the headline numbers as capability signals under lab conditions, not as a forecast for hardened production environments.

Comparison

vs Model tiers

Where it sits on the capability ladder

Mythos is a frontier-tier model, the top rung of the capability ladder. The model-tiers page maps that ladder in general: this page is the concrete frontier exemplar, distinctive not for being frontier but for its security capability and its gated release. Read the ladder there, then read why this particular rung-topper earned its own page here.

vs Choosing a model

How it fares in a real selection process

In the choosing-a-model funnel, Mythos is eliminated for almost everyone at the very first step: the non-negotiables. No access is a hard constraint, and a model you cannot call is out before capability ever enters the conversation. That is exactly why most teams should reason about Mythos as landscape, not as a candidate: the selection process rules it out for you.

Resources

FAQ

What is Claude Mythos?: A general-purpose frontier model from Anthropic, introduced on 2026-04-07, that is strikingly strong at multi-step cybersecurity work, finding software vulnerabilities at a level that surprised the industry. Its distinctive feature is not raw capability but that capability paired with a deliberately restricted release. We describe it as a landscape entry, not a tool we run.
Can I use Mythos in production?: Almost certainly not. Mythos is gated: Anthropic did not release it publicly and access is limited to vetted Project Glasswing participants, defensive security teams, critical industry partners and open-source maintainers who meet security requirements. There is no public API for the general developer. For the overwhelming majority of teams the realistic relationship is to understand it, not to use it.
What is Project Glasswing?: Anthropic's vetted consortium and access programme for Claude Mythos, formed around the model's cybersecurity capability. It grants access to defenders, critical industry partners and open-source maintainers who clear security requirements, and gates the general public out. The intent is to put a frontier vulnerability-finding capability in defenders' hands before attackers reach equivalent power.
Why does Mythos get its own page when Haiku does not?: Because a model earns a page only when it has a distinctive, defensible story, not when it merely posts a good benchmark. A mid-tier or small model is a catalogue entry: you pick a tier, read a row, and move on. Mythos changes how you think about the landscape, a frontier security capability behind a novel gated-access model the whole industry is reacting to. That is the page-worthiness criterion, and Mythos is its clearest example.
Is it safe to publish a model this capable at security?: It is genuinely debated, and we keep it balanced. The case for the gated release: a vulnerability-finding capability is dual-use, so giving defenders a head start to find and patch flaws before attackers reach equivalent capability can shift the balance toward defence, this is the responsible-disclosure argument at scale. The concern: it concentrates a powerful dual-use capability behind one vendor's gate, and the transition is risky. Reasonable people land on both sides; the honest position is to hold the tension rather than resolve it cheaply.