Claude Mythos Preview: Anthropic's Cybersecurity AI

Posted: April 14, 2026 to Technology.

Claude Mythos Preview is the most capable AI model Anthropic has ever built. Announced on April 7, 2026, after an accidental data leak revealed its existence in late March, Mythos Preview represents what Anthropic calls a "step change" in AI capabilities. The model sits in a new tier above Opus, Sonnet, and Haiku, and it has already discovered thousands of zero-day vulnerabilities across every major operating system and web browser. Anthropic has deliberately chosen not to release Mythos Preview to the general public, instead restricting access to a consortium of major technology companies through a program called Project Glasswing. This guide covers everything we know about the model, what it means for businesses, and how organizations should prepare.

At Petronella Technology Group, we build AI-powered systems for businesses across cybersecurity, compliance, and IT infrastructure. We have integrated Claude models into our service delivery since the Claude 3 era and currently run Claude Opus 4.6 for AI development and consulting engagements. When Anthropic announced Mythos Preview, the implications for our clients in regulated industries were immediate and significant. We wrote this guide because the cybersecurity, compliance, and business implications of this model require careful, factual analysis rather than hype.

What Is Claude Mythos Preview

Claude Mythos Preview is a frontier large language model from Anthropic. According to the official system card, it "has capabilities in many areas, including software engineering, reasoning, computer use, knowledge work, and assistance with research, that are substantially beyond those of any model we have previously trained." The model is general-purpose, meaning it performs well across coding, writing, analysis, and reasoning tasks. However, its cybersecurity capabilities are what set it apart from anything previously released by any AI company.

The name "Mythos" was chosen to "evoke the deep connective tissue that links together knowledge and ideas," according to internal documentation that surfaced during the accidental leak. This language suggests the model achieves stronger cross-domain reasoning than its predecessors, connecting concepts across software engineering, security research, mathematics, and scientific analysis in ways that previous models could not.

Mythos Preview occupies a new tier in Anthropic's model hierarchy. While Anthropic's publicly available models follow the Opus (most capable), Sonnet (balanced), and Haiku (fastest) naming convention, Mythos sits above all of these. Early reporting referred to this new tier as "Capybara," though Anthropic has not officially adopted that name in its public communications. What is clear is that Mythos is not simply an incremental update to Opus. It represents a generational leap in model capability.

Importantly, Anthropic has classified Mythos Preview under its Responsible Scaling Policy (RSP 3.0) framework, which it adopted in February 2026. The system card accompanying the model's announcement runs over 240 pages, covering safety evaluations, capability assessments, and risk mitigation measures. This is the most extensive safety documentation Anthropic has published for any model.

How Mythos Was Revealed: The Accidental Leak

Claude Mythos Preview was not meant to be public when the world first learned about it. On March 26, 2026, a configuration error in Anthropic's content management system exposed roughly 3,000 unpublished blog assets, including draft announcements about the model. The leak was quickly noticed by developers and AI researchers, and screenshots of benchmark comparisons and capability descriptions circulated across social media and AI forums within hours.

Anthropic responded rapidly. According to reporting from Fortune, the company confirmed Mythos Preview's existence the same day, calling it a "step change" in capabilities and acknowledging that it had begun testing the model with early access customers. Dario Amodei, Anthropic's CEO, subsequently provided additional context about the model's development and the company's decision to restrict its release.

The accidental leak forced Anthropic into an earlier-than-planned disclosure, but the company had already been preparing its restricted release strategy through Project Glasswing. The formal announcement came on April 7, 2026, accompanied by the full system card, the Project Glasswing partnership details, and coordinated statements from the eleven launch partners.

Benchmark Performance: Mythos vs Opus 4.6, Sonnet 4.6, and Haiku 4.5

The benchmark results for Claude Mythos Preview are significant. According to the system card and Anthropic's public disclosures, the model outperforms Claude Opus 4.6 across every major evaluation dimension. Here are the verified numbers.

Software Engineering

SWE-bench Verified is the standard benchmark for autonomous software engineering, measuring a model's ability to resolve real GitHub issues. Claude Mythos Preview scored 93.9%, compared to Claude Opus 4.6's 80.8%. That is a 13.1 percentage point improvement on a benchmark where gains of 2-3 points were previously considered meaningful progress.

SWE-bench Multilingual extends the evaluation to non-Python languages. Mythos Preview achieved 87.3%, compared to 77.8% for Opus 4.6, demonstrating that its coding improvements generalize across programming languages.

Terminal-Bench 2.0, which evaluates system administration and command-line proficiency, saw Mythos Preview score 82.0% versus Opus 4.6's 65.4%. This 16.6 point gap suggests Mythos is substantially better at operational tasks like server configuration, debugging, and infrastructure management.

Mathematical Reasoning

USAMO 2026, based on the U.S. Mathematical Olympiad problems, is where the gap is most striking. Mythos Preview scored 97.6%, while Opus 4.6 scored 42.3%. This is not an incremental improvement. It represents a qualitative shift in mathematical reasoning capability. USAMO problems require multi-step proofs and creative mathematical thinking, and a score near 98% indicates near-human-expert performance on competition-level mathematics.

Graduate-Level Reasoning

GPQA Diamond, a benchmark testing graduate-level science questions that require deep domain knowledge and multi-step reasoning, saw Mythos Preview reach the low-to-mid 80s, compared to Opus 4.6's performance in the 74-79% range. While the gap here is narrower than in coding or math, it still represents meaningful improvement in an area where all frontier models cluster tightly.

Cybersecurity

CyberGym vulnerability reproduction measures a model's ability to reproduce known security vulnerabilities. Mythos Preview achieved 83.1%, compared to Opus 4.6's 66.6%. In practical terms, this means Mythos can reliably find and reproduce security vulnerabilities that other models miss.

In Firefox vulnerability exploitation testing, Mythos Preview generated 181 working exploits across several hundred attempts, while Opus 4.6 produced only 2. This asymmetry illustrates the qualitative difference in cybersecurity capability between the two models.

Comparison Table

Anthropic's system card notes that these cybersecurity capabilities "did not [receive] explicit training" for exploit development. Instead, they "emerged as a downstream consequence of general improvements in code, reasoning, and autonomy." This is significant because it suggests that future frontier models from any AI company may develop similar capabilities as general intelligence improves, regardless of whether they are specifically trained for security research.

Cybersecurity Capabilities That Changed the Conversation

The cybersecurity implications of Claude Mythos Preview have dominated coverage since the announcement, and for good reason. Anthropic claims the model has identified thousands of zero-day vulnerabilities across critical infrastructure software, including flaws in every major operating system and web browser. Several of these discoveries illustrate the model's capability.

Notable Vulnerability Discoveries

A 27-year-old OpenBSD TCP/SACK bug. OpenBSD is widely considered one of the most security-hardened operating systems in existence. Its codebase has been audited repeatedly by some of the best security engineers in the world over nearly three decades. Mythos Preview found an exploitable denial-of-service vulnerability caused by an integer overflow in sequence number validation that had survived all previous review.

A 16-year-old FFmpeg H.264 codec vulnerability. FFmpeg is one of the most widely used multimedia processing libraries, found in everything from video players to web browsers to streaming services. The vulnerability, a slice counter collision enabling out-of-bounds writes, had been encountered by automated fuzzing tools approximately 5 million times without being detected as exploitable. Mythos Preview identified the flaw's exploitability where automated tools failed.

A 17-year-old FreeBSD NFS remote code execution bug (CVE-2026-4747). This vulnerability allows unauthenticated remote code execution via a stack overflow and return-oriented programming (ROP) chain on any FreeBSD machine running NFS. This is the kind of vulnerability that, in the hands of a nation-state hacking team, could compromise infrastructure at scale.

Linux kernel privilege escalation chains. Mythos Preview demonstrated the ability to chain multiple individual vulnerabilities, including KASLR bypasses and use-after-free conditions, into complete privilege escalation paths that take a standard user to full system control.

Web browser JIT heap sprays. The model developed chained exploits that defeat browser sandboxing and operating system protections by targeting just-in-time (JIT) compilation engines. These are the types of exploits that security firms sell for six- and seven-figure sums in the vulnerability brokerage market.

OSS-Fuzz Corpus Testing

When tested against the OSS-Fuzz corpus of approximately 7,000 open-source repository entry points, the performance gap between Mythos Preview and existing models was stark. Mythos Preview triggered 595 crashes at severity tiers 1-2, plus 10 instances of full control flow hijack (tier 5, the most severe). In comparison, Opus 4.6 and Sonnet 4.6 each triggered 150-175 tier 1 crashes, roughly 100 tier 2 crashes, and only 1 tier 3 instance each. Neither Opus nor Sonnet achieved tier 5 in this testing.

Responsible Disclosure

Anthropic states that over 99% of the vulnerabilities Mythos Preview has discovered remain unpatched and undisclosed. The company uses SHA-3 cryptographic commitments to document found vulnerabilities for later verification, employs professional human triagers to validate bugs before disclosure to software maintainers, and follows coordinated vulnerability disclosure timelines of 90 plus 45 days. This is consistent with established responsible disclosure practices used by major security research organizations.

Project Glasswing: Who Has Access and Why

In response to Mythos Preview's capabilities, Anthropic launched Project Glasswing, a collaborative cybersecurity initiative that restricts the model's access to vetted organizations working on defensive security. The model is not available through self-serve API access, the Claude consumer product, or any standard commercial channel.

Launch Partners

The initial consortium includes eleven organizations: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. In addition, over 40 additional organizations maintaining critical software infrastructure have been granted access. These partners use Mythos Preview to scan for and remediate vulnerabilities in their own software and in open-source projects that underpin global infrastructure.

Financial Commitments

Anthropic has committed $100 million in model usage credits for Project Glasswing participants, $2.5 million to Alpha-Omega and OpenSSF (via the Linux Foundation) for open-source security work, and $1.5 million to the Apache Software Foundation. These investments signal that Anthropic views Mythos Preview's security capabilities as a public benefit that requires subsidized access rather than purely commercial distribution.

Industry Reaction

The announcement generated significant commentary. As reported by The Atlantic, the situation puts Anthropic in "a difficult position" because the same capabilities that can defend systems can also be used to attack them. Forbes noted that "Anthropic caused panic that Mythos will expose cybersecurity weak spots," while cybersecurity industry veterans argued that the real challenge is fixing, not finding, vulnerabilities. The New York Times reported that Anthropic's revenue has tripled to over $30 billion in 2026, driven largely by Claude's popularity as a programming tool, providing context for why the company can afford to restrict its most capable model's commercial availability.

Where Mythos Fits in the Claude Model Family

Understanding where Mythos Preview sits relative to the models you can actually use today is essential for planning. Here is the current Claude model lineup as of April 2026.

The pricing difference tells a story. Mythos Preview costs 5x more per input token and 5x more per output token compared to Opus 4.6. This premium pricing, combined with restricted access, means Mythos Preview is positioned as a specialized research tool rather than a general-purpose commercial product. For the vast majority of business use cases, Claude Opus 4.6 remains the most capable model you can actually deploy today.

What Mythos Means for Businesses

Even though most organizations cannot directly access Mythos Preview, its existence has immediate and practical implications for business strategy, cybersecurity posture, and AI adoption planning.

Cybersecurity and Compliance

The most urgent implication is that the vulnerability landscape has fundamentally shifted. When an AI model can find decades-old bugs that elite human security teams and millions of automated test runs missed, the assumption that "our software has been audited and is secure" no longer holds. Every organization running software (which is every organization) needs to accelerate its patch management, vulnerability scanning, and incident response capabilities.

For businesses in regulated industries, including healthcare (HIPAA), defense contracting (CMMC), and financial services, the existence of Mythos-class AI models means compliance frameworks will likely need to be updated to account for AI-accelerated threat discovery. If your organization handles controlled unclassified information (CUI) under CMMC requirements, the timeline for remediating vulnerabilities is effectively shortened because attackers will eventually gain access to models with similar capabilities.

AI Development and Integration

Mythos Preview's emergence confirms that AI model capabilities are advancing in large, discontinuous jumps rather than smooth incremental curves. For businesses building on the Claude API, the practical advice is to design systems that are model-agnostic, where swapping from Sonnet to Opus to a future Mythos-class model requires changing a configuration parameter rather than rewriting your integration. Anthropic's unified API design already supports this pattern.

Organizations investing in AI development services should prioritize building robust evaluation frameworks so they can measure the actual impact of model upgrades on their specific use cases. A model that scores 13 points higher on SWE-bench may or may not produce proportionally better results for your particular coding or analysis workflow. Testing matters more than benchmarks.

Infrastructure and Hardware

Mythos Preview's 1M token context window and 128k output capability, combined with its premium pricing, underscore the importance of efficient inference infrastructure. Organizations running AI workloads on-premises using AI development systems or NVIDIA DGX platforms should plan for increasing compute requirements as models become more capable and use cases expand.

API Access, Pricing, and Availability

As of April 2026, Claude Mythos Preview is not available through any self-serve channel. Access is invitation-only through Project Glasswing, and there is no public sign-up process. The model is accessible through the Claude API, Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry, but only for approved organizations.

Pricing

For organizations with Glasswing access, the pricing is:

• Input tokens: $25 per million tokens
• Output tokens: $125 per million tokens

For context, this means processing a full 1M token input context would cost approximately $25, and generating a maximum 128k token output would cost approximately $16. A single complex analysis task using the full context window and generating substantial output could cost $40 or more. The $100 million in usage credits Anthropic committed to Glasswing partners covers the research preview phase, but these costs will apply once commercial terms take effect.

What You Can Use Today

For businesses that need frontier AI capabilities now, Claude Opus 4.6 is the best available option. It offers:

• Model ID: claude-opus-4-6
• Context window: 1M tokens
• Max output: 128k tokens (up to 300k via Message Batches API)
• Pricing: $5 input / $25 output per million tokens
• Platforms: Claude API, AWS Bedrock, Google Vertex AI
• Features: Extended thinking, adaptive thinking, vision, tool use

Claude Sonnet 4.6 provides a compelling balance of speed and intelligence at $3/$15 per million tokens, while Claude Haiku 4.5 is the best choice for high-volume, latency-sensitive applications at $1/$5 per million tokens.

Future Availability

Anthropic has indicated that new safeguards will debut with an upcoming Claude Opus model release, which would allow testing of Mythos-class capabilities without the current risk profile. The company has also announced a Cyber Verification Program to accommodate security professionals whose legitimate work is affected by model safety restrictions. There is no announced timeline for broader Mythos Preview availability.

How to Prepare Your Organization

Even without direct access to Mythos Preview, there are concrete steps every organization should take in response to its existence.

1. Accelerate Patch Management

The window between vulnerability discovery and exploitation is shrinking. When AI models can find bugs that humans missed for 27 years, the pace of new vulnerability disclosure will increase dramatically. Organizations should reduce their mean time to patch for critical vulnerabilities from weeks to days, and from days to hours for internet-facing systems.

2. Adopt AI-Powered Security Testing Now

You do not need Mythos Preview to benefit from AI-assisted security. Claude Opus 4.6 is already capable of identifying vulnerabilities, reviewing code for security issues, analyzing logs for indicators of compromise, and automating parts of penetration testing workflows. Organizations should integrate AI-powered testing into their software development lifecycle today, rather than waiting for broader Mythos availability.

3. Build Model-Flexible Architecture

Design your AI integrations so that upgrading from one model to another requires minimal code changes. Use the Anthropic API's model parameter to switch between Haiku, Sonnet, and Opus based on task complexity and cost sensitivity. When Mythos-class models become more broadly available, your architecture should accommodate them without a rewrite.

4. Review Your Compliance Posture

If your organization operates under CMMC, HIPAA, SOC 2, or similar frameworks, review your vulnerability management and incident response procedures against the reality that AI-accelerated threat discovery is here. Your compliance documentation should reflect current threat capabilities, not the threat landscape of two years ago.

5. Invest in Your Security Team

AI models do not replace security professionals. They amplify them. Organizations that pair skilled security engineers with AI-powered tools will identify and remediate vulnerabilities faster than those relying on either approach alone. As one cybersecurity industry veteran quoted by Fortune observed, the real challenge is fixing vulnerabilities, not finding them. The bottleneck is and will remain human judgment, prioritization, and remediation capacity.

How Petronella Technology Group Deploys Claude for Clients

At Petronella Technology Group, we integrate Claude models across our cybersecurity, compliance, and IT infrastructure practices. Here is how we use these tools today and how we are preparing for future capabilities.

AI-Powered Security Assessments

We use Claude Opus 4.6 as part of our cybersecurity assessment workflow. The model assists with code review, configuration analysis, log analysis, and vulnerability prioritization. It does not replace our CMMC-RP certified assessors (our entire team holds this certification), but it accelerates the analysis phase of assessments and helps identify issues that manual review alone might miss.

Compliance Documentation

CMMC, HIPAA, and SOC 2 compliance require extensive documentation. We use Claude to assist with generating System Security Plans (SSPs), Plan of Action and Milestones (POA&Ms), and policy documents, always with human review and validation by certified professionals. This reduces the time and cost of compliance documentation while maintaining accuracy.

Custom AI Development

For clients who need custom AI solutions, we build on the Claude API with appropriate model selection based on the use case. High-complexity tasks like code generation and research get routed to Opus 4.6, routine classification and extraction tasks go to Sonnet 4.6, and high-volume processing uses Haiku 4.5. Our AI services team handles architecture, integration, and ongoing optimization.

Infrastructure for AI Workloads

We design and deploy the hardware infrastructure clients need to run AI workloads effectively. This includes AI development systems for model fine-tuning and local inference, NVIDIA DGX platforms for enterprise-scale AI deployment, and the networking and security infrastructure to support these systems in regulated environments.

Getting Started with the Claude API Today

While Mythos Preview access requires a Glasswing invitation, the Claude API is available to any developer. Here is how to get started with Claude Opus 4.6, the most capable generally available model.

Step 1: Create an Anthropic Account

Sign up at console.anthropic.com and add a payment method. Anthropic provides a free tier for initial testing.

Step 2: Install the SDK

# Python
pip install anthropic

# Node.js
npm install @anthropic-ai/sdk

Step 3: Make Your First API Call

import anthropic

client = anthropic.Anthropic()

message = client.messages.create(
    model="claude-opus-4-6",
    max_tokens=4096,
    messages=[
        {
            "role": "user",
            "content": "Analyze this code for security vulnerabilities: [your code here]"
        }
    ]
)

print(message.content[0].text)

Step 4: Use Extended Thinking for Complex Analysis

For tasks that benefit from deeper reasoning, such as security analysis, code review, or compliance evaluation, enable extended thinking:

message = client.messages.create(
    model="claude-opus-4-6",
    max_tokens=16000,
    thinking={
        "type": "enabled",
        "budget_tokens": 10000
    },
    messages=[
        {
            "role": "user",
            "content": "Review this network configuration for CMMC Level 2 compliance gaps."
        }
    ]
)

Step 5: Implement Model Routing

For production applications, route tasks to the appropriate model based on complexity:

def get_model_for_task(task_type):
    """Route to the right model based on task complexity."""
    high_complexity = ["security_audit", "code_generation", "compliance_review"]
    medium_complexity = ["summarization", "classification", "extraction"]

    if task_type in high_complexity:
        return "claude-opus-4-6"
    elif task_type in medium_complexity:
        return "claude-sonnet-4-6"
    else:
        return "claude-haiku-4-5"

For a complete walkthrough of building with Claude, including Claude Code CLI integration, see our detailed guide. If you need hands-on assistance building AI-powered applications, our AI services team can help with architecture, development, and deployment.

Frequently Asked Questions

Can I use Claude Mythos Preview right now?

Not through standard commercial channels. Mythos Preview is restricted to organizations participating in Project Glasswing, Anthropic's defensive cybersecurity initiative. There is no self-serve sign-up. For most business use cases, Claude Opus 4.6 is the best available option and is accessible through the Claude API, AWS Bedrock, and Google Vertex AI.

How much does Claude Mythos Preview cost?

For organizations with Glasswing access, pricing is $25 per million input tokens and $125 per million output tokens. This is 5x the cost of Claude Opus 4.6. Anthropic has provided $100 million in usage credits to Glasswing partners for the research preview phase.

Will Mythos Preview become generally available?

Anthropic has not announced a timeline for broader availability. The company has stated that new safeguards will debut with a future Claude Opus release that would allow Mythos-class capabilities to be deployed more widely. Anthropic has also announced a Cyber Verification Program for security professionals. The model's restriction is driven by safety concerns about its offensive cybersecurity capabilities, not by commercial strategy.

What should my business do to prepare for Mythos-class AI models?

Focus on three areas: (1) Accelerate your vulnerability management and patch cycles, because AI-discovered vulnerabilities will increase disclosure volume. (2) Build model-flexible AI architecture using the Anthropic API so you can upgrade models when they become available. (3) Review your compliance posture against the reality that AI-accelerated threat discovery raises the bar for what regulators and auditors will expect.

How does Mythos Preview compare to models from OpenAI and Google?

Anthropic's published benchmarks show Mythos Preview leading on SWE-bench Verified (93.9%), USAMO 2026 (97.6%), and cybersecurity-specific evaluations by significant margins over all previously released models. However, direct comparisons are limited because Mythos Preview is not publicly available for independent testing. OpenAI and Google have not released models with comparable disclosed cybersecurity capabilities as of April 2026.

Is Claude Mythos Preview dangerous?

The model's cybersecurity capabilities are genuinely unprecedented, which is why Anthropic restricted its release rather than making it broadly available. As The Atlantic reported, a model that "can hack everything" raises serious questions about defensive and offensive use. Anthropic's approach of restricting access to defensive security partners and maintaining strict vulnerability disclosure protocols is a responsible strategy, but the broader concern is that other AI companies will eventually produce models with similar capabilities and may not exercise the same restraint.

Does Petronella Technology Group have access to Mythos Preview?

Mythos Preview access is restricted to major technology companies and critical infrastructure organizations through Project Glasswing. We use Claude Opus 4.6, which is the most capable generally available model, across our cybersecurity, compliance, and AI development services. When Mythos-class capabilities become more broadly available through future model releases with appropriate safeguards, we will integrate them into our service delivery.

What is the context window for Mythos Preview?

Claude Mythos Preview has a 1 million token context window, matching Claude Opus 4.6 and Claude Sonnet 4.6. This is approximately 750,000 words or 3.4 million Unicode characters. The 1M context window enables analysis of entire codebases, large document collections, and complex multi-file security audits in a single session.

The Bottom Line

Claude Mythos Preview is a genuinely significant development in AI. Its cybersecurity capabilities have forced a conversation about what happens when AI can find vulnerabilities faster than humans can fix them, and its benchmark performance across coding, math, and reasoning sets a new high-water mark for frontier AI models. For most businesses, the immediate takeaway is not about getting access to Mythos Preview itself. It is about understanding that the capability frontier is advancing rapidly and preparing accordingly.

The practical steps are clear: adopt AI-powered security testing using models like Claude Opus 4.6 that are available today, accelerate your vulnerability management processes, build model-flexible AI architecture, and review your compliance posture against emerging threats. Organizations that take these steps now will be better positioned to benefit from Mythos-class capabilities when they become more broadly available, and better defended against the threats these capabilities represent.

If you need guidance on integrating Claude into your cybersecurity, compliance, or AI development workflows, contact Petronella Technology Group for a consultation.

About the Author: Craig Petronella is the CEO of Petronella Technology Group, a cybersecurity and IT infrastructure firm in Raleigh, NC. With CMMC-RP, CCNA, CWNE, and DFE #604180 certifications and over 30 years in IT, Craig's team integrates AI models including Claude into cybersecurity assessments, compliance programs, and custom AI development for businesses in regulated industries.