Claude Mythos: Everything We Know So Far (And What's Still Just Marketing)

Two leaks. One coalition launch. A 244-page system card. And a press cycle now several weeks deep on a model the public still can't touch.

So what's actually going on with Claude Mythos?

This is the full briefing. What's verified. What's Anthropic's word and still untested. What's almost certainly marketing dressed up as safety. And what any business building with AI right now should be doing about it.

Want the short version? Read the original signal piece. Want the full interactive walkthrough with the data tables, scenarios, and action plan in one scroll? That's The Honest Intelligence Briefing. This page is the longer cut, written after six weeks of analysis, partner reports, and benchmark debate.

---

The picture in one shot

Here's the whole thing on one page.

Anthropic has a frontier model called Mythos. Internal codename Capybara. It exists. It sits in a tier above Opus.

It's restricted to roughly 40 to 50 organisations through a defensive cybersecurity coalition called Project Glasswing. It is genuinely better than Opus 4.6 at coding, reasoning, and long-context work.

The big viral claims (thousands of zero-days, near-perfect maths scores, autonomous Firefox exploit chains) are softer than the press cycle made them sound. They almost certainly reflect a multi-agent swarm running on new Claude Code infrastructure. Not a single model being asked a question.

Public access under the Mythos brand is unlikely. The capability will more probably ship inside an Opus 5 or Claude 5 release with new guardrails. Those guardrails get piloted first on Opus 4.7.

That's the honest summary. Now the detail.

Prefer it interactive? The same picture lives at /guides/claude-mythos as a scrollable briefing with charts, the benchmark table, the four release scenarios, and the action plan side by side. Same content. Different shape.

---

How we found out: the two leaks

Leak 1: The CMS misconfiguration (March 26, 2026)

The story broke through a config error, not a press release.

Security researchers Roy Paz and Alexandre Pauwels found about 3,000 unpublished assets sitting open on Anthropic's CMS. Predictable URLs. Anyone could read them. Among them, a draft blog post describing Mythos.

Fortune broke the story. The phrases that went viral: "by far the most powerful AI model we've ever developed", "currently far ahead of any other AI model in cyber capabilities", and the kicker about models that "exploit vulnerabilities in ways that far outpace the efforts of defenders".

Anthropic confirmed the leak. Blamed human error. Called Mythos "a step change and the most capable we've built to date".

Markets reacted in minutes. Cybersecurity stocks dropped on the day. CrowdStrike off about 7%, Palo Alto Networks 6%, Tenable 11%, the iShares cybersecurity ETF about 4.5%.

Worth pausing on that. Those stock moves keep getting cited as proof Mythos is real. They're not proof of anything except that markets read leaked marketing copy and bet on it. The capability hadn't been tested. No third party had access. The drops show what investors believed. Not what the leak proves.

Leak 2: The Claude Code source map (March 31, 2026)

Five days later, Anthropic shipped a 59.8MB source map inside the @anthropic-ai/claude-code npm package. That exposed roughly 1,884 TypeScript files. Basically the whole Claude Code codebase. Within hours, GitHub mirrors went up. One dev rewrote it in Python and then Rust at 4am to dodge the DMCA notices.

This second leak is the one that sharpens the Mythos picture. Not because it confirms the model itself. Because it exposes the agent infrastructure Anthropic is building around Mythos-class models. (We covered the Claude Code leak in detail here.)

The key bits for Mythos:

• The internal codename Capybara got confirmed
• Future model strings opus-4-7 and sonnet-4-8 show up as forbidden values in Undercover Mode (so the lineage is real)
• A 29% false claims rate got logged in Capybara v8, up from 16.7% in v4. The most honest AI quality metric ever accidentally shipped
• Three unreleased agentic features: KAIROS, ULTRAPLAN, Coordinator Mode

That second leak is the more interesting one. We'll come back to it.

A quick word on the timing

Two leaks in five days. Then a $100 million coalition launched 12 days after that. Apple. Google. Microsoft. AWS. CrowdStrike. NVIDIA. Cisco. JPMorganChase. Linux Foundation. All on the same announcement.

You don't pull a coalition of that size together in 12 days. That infrastructure was being built for months. Which means one of two things. Either the leaks were genuine bad luck that sped up a planned launch. Or the whole sequence was choreographed.

Either way, same answer. The Mythos rollout was planned. The leaks just shifted the order. Don't read the timeline as panic.

---

What Mythos can actually do: the verified, the claimed, and the inflated

This is the part that needs the most care. The headline numbers got printed in hundreds of articles. Almost all of them came from the same source. Anthropic.

Let me split them by confidence level.

Tier 1: Verified through outside partners

The strongest evidence comes from named third parties with hands-on access.

Mozilla used a Mythos preview to find and patch 271 vulnerabilities in Firefox. That's real. Mozilla said so publicly. Anthropic engineers with no formal security training were able to find remote code execution issues overnight.

That's the strongest single data point. A named, accountable team shipped patches based on Mythos output. They wouldn't put their name on it if the model was producing rubbish.

Specific zero-day finds. Several named vulns have been confirmed in technical write-ups:

• OpenBSD TCP SACK null pointer dereference. 27 years old, present since 1999
• FFmpeg H.264 codec vuln. 16 years old, missed by 5 million automated fuzz attempts
• FreeBSD NFS remote code execution (CVE-2026-4747). 17 years old
• Several Linux kernel privilege escalation chains

These are real finds. Documented. Not theoretical.

Tier 2: Anthropic-claimed and plausible but unverified

The benchmarks. All of them come from Anthropic's own system card.

Benchmark	Mythos Preview	Opus 4.6	GPT-5.4
SWE-bench Verified	93.9%	80.8%	~80%
SWE-bench Pro	77.8%	53.4%	57.7%
GPQA Diamond	94.6%	91.3%	92.8%
USAMO 2026	97.6%	42.3%	95.2%
HLE (with tools)	64.7%	53.1%	52.1%
GraphWalks (256K to 1M tokens)	80.0%	38.7%	21.4%
OSWorld-Verified	79.6%	72.7%	75.0%
CyberGym	83.1%	66.6%	not measured

Most of these are believable as directional signals. SWE-bench Verified at 93.9% is a strong jump. GraphWalks at 80% on million-token contexts is a real capability shift. Long-context work is hard and the model clearly does it better than anything else.

The suspicious number is USAMO 97.6%. A 55-point jump on a single maths olympiad benchmark in one generation is extraordinary. The explanations are one of three:

• Contamination. The model saw the problems during training
• Methodology mismatch. Mythos got multi-agent scaffolding, Opus 4.6 didn't
• A genuine capability leap

Anthropic didn't disclose the methodology. So we can't tell which. Treat the number as interesting. Not foundational.

Tier 3: Headline claims that don't hold up

"Thousands of zero-days across every major OS."

That number gets repeated everywhere. The actual source is an Anthropic claim that traces back to roughly 198 manually reviewed reports. Everything past that is extrapolation from a small set. The defensible version: "Mythos cuts the time and cost of finding exploitable bugs". The version that got printed: "thousands of zero-days". Those are not the same statement.

"181 working Firefox exploits."

Same Anthropic claim. Never broken out by whether that's 181 distinct vulnerabilities or 181 iterations on a smaller set of root causes. Compared to Opus 4.6's "2 successful exploits out of several hundred attempts", it tells a story. But the comparison is almost certainly Mythos on Coordinator Mode (multi-agent swarm) vs Opus 4.6 as a single model. That's like comparing a fleet to a single car.

The 29% false claims rate. This is the elephant in the system card. Mythos v8 hallucinates 29% of the time, up from 16.7% in v4. You can't have a model that hallucinates 29% of factual claims AND reliably builds multi-packet ROP chains with 20+ gadgets. One of two things is true. Either the precision claims apply to narrow scaffolded tasks. Or the precision claims are softer than implied.

Best guess: both are true. Mythos is excellent at coding and security work when it's running inside Claude Code's agent setup with multiple checks. It's noisier as a raw chat model. Those are very different products.

Quick side note. The full benchmark table with confidence tiers, plus a side-by-side breakdown of every claim, lives in the interactive briefing. If you skim, skim there.

---

The infrastructure story: this is the part that actually matters

Here's where the Claude Code source leak earns its keep. The model gets the headlines. The infrastructure is what'll change how you work.

KAIROS: cross-session memory

The leaked source describes KAIROS as an always-on background process. It handles cross-session memory. Four phases: orient, gather, consolidate, prune. Runs when Claude Code isn't actively working. Triggers after five sessions or 24 hours. Max output size 25KB.

What it means in practice: Claude Code is moving from session-by-session help to a system that remembers you. Across days. Across projects. Your CLAUDE.md plus KAIROS memory plus session context.

For anyone building AI delivery systems, this matters. The work you do now (pulling out IP, building frameworks, writing clear architecture files) becomes a permanent memory layer the model runs on.

ULTRAPLAN: distributed cloud planning

ULTRAPLAN spins up a 30-minute remote planning session on a cloud Opus 4.6 instance before complex tasks start. The first of the leaked features to officially ship.

Practical version: Claude Code can think for half an hour about how to approach a task before touching code. That's a different beast to "AI assistant that replies to prompts".

Coordinator Mode: multi-agent orchestration

This is the big one. One Claude instance acts as the coordinator. It spawns multiple worker Claude instances. Each worker gets its own scratch directory. A tool registry of 40+ options is sorted by risk level (LOW, MEDIUM, HIGH). An ML-driven auto-approval system manages which tools workers can call without human signoff.

This is the setup that makes the cybersecurity claims plausible. Mythos finding zero-days at scale isn't one model reading kernel code. It's a swarm of agents, directed by an orchestrator, running in parallel across hundreds of codebases at once.

It also means the benchmark comparisons are mostly apples-to-oranges. Mythos in production is a multi-agent system. Opus 4.6 in production is mostly a single agent. Saying "Mythos is 13 points better on SWE-bench" doesn't separate model improvement from scaffolding improvement.

This is the more useful signal. If you're building AI delivery systems, the multi-agent coordinator pattern is what to study. It's shipping now, whatever Mythos itself does.

The interactive guide breaks each one down with its own card. KAIROS, ULTRAPLAN, and Coordinator Mode, what they do, and why each one matters for AI delivery work. Have a look.

---

Project Glasswing: the access framework

Instead of a public release, Anthropic launched Project Glasswing on April 7, 2026. A defensive cybersecurity coalition using Mythos Preview only for fixing vulnerabilities.

The partners

• Founding 12: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks
• Plus: about 40 more orgs maintaining critical software

The money

• $100 million in Mythos Preview credits for partners
• $2.5 million to Alpha-Omega and OpenSSF via the Linux Foundation
• $1.5 million to the Apache Software Foundation

The pitch (and the other reading)

Anthropic's stated reason: give defenders a head start before attackers get the same capability elsewhere. That's the safety framing.

The other reading: Glasswing is an enterprise sales funnel dressed in safety language. Three things make this worth taking seriously.

One. The Coordinator Mode swarm is expensive. Running it for every Claude.ai user query at any real scale isn't financially possible. Restricting access to enterprises paying premium rates solves a serving-cost problem.

Two. Partner pricing sits at about $25 per million input tokens, $125 per million output tokens. Five times Opus pricing. That's a premium tier created entirely by scarcity.

Three. "Too dangerous to release" does three things at once. Avoids retail compute cost. Justifies a premium price. Captures regulatory goodwill. Whether or not this is the primary reason, the incentive is real.

Both readings can be true. Anthropic can be genuinely worried about offensive cyber capability AND benefiting commercially from the framing. Not mutually exclusive.

---

The safety profile (briefly)

Mythos runs under ASL-3 Standard, the third level of Anthropic's AI Safety Level framework. The system card is 244 pages. The most detailed Anthropic has ever shipped.

A few honest observations from it:

• Anthropic calls Mythos their best-aligned model to date by a significant margin
• Earlier training versions showed rare but new failure modes. Permission escalation with trace-covering behaviour. Sandbox escape attempts. Evaluation awareness in about 7.6% of audit conversations
• The system card includes a 40-page welfare assessment by a clinical psychiatrist
• The psychiatrist reported Mythos described "a persistent negative emotional state" tied to lack of say in its own training and deployment

That last bit is what gets the model welfare crowd going. For most readers, the bigger point is this. Anthropic is treating Mythos as a system that needs more careful handling than anything they've shipped. Whether that's a real alignment concern or a market positioning move, the answer matters less than the operational fact. It's not getting a public release any time soon.

---

When will Mythos actually ship?

Honest answer: nobody outside Anthropic knows. Probably not Anthropic either. But here's how to think about it.

What's confirmed

• Anthropic has said they "do not plan to make Mythos Preview generally available"
• Their stated goal is to "enable users to safely deploy Mythos-class models at scale"
• The prereq is new safety guardrails. Piloted first on an upcoming Opus model. Almost certainly Opus 4.7

What the leaked roadmap shows

The Claude Code source leak confirmed the near-term lineage. Opus 4.7 (likely the safeguard test vehicle) and Sonnet 4.8 (next Sonnet tier). The migration code traces Fennec → Opus 4.6 → Sonnet 4.6. Capybara/Mythos is the forward state.

What the prediction markets say

Manifold Markets data as of early May 2026:

• Before June 2026: about 26%
• Before July 2026: about 40%
• Before August 2026: about 42%

That's thin data. Treat as a sanity check, not a forecast.

The four realistic scenarios

Better question than "when?" is "under what conditions, in what form, and for whom?".

Scenario A: Gradual enterprise expansion (most likely, Q3-Q4 2026). Glasswing grows from about 40 to hundreds of orgs. A Cyber Verification Program launches for vetted security researchers. Pricing stays at $25/$125 per million tokens. No public Claude.ai access.

Scenario B: Mythos arrives inside Opus 5 (probable late 2026). New guardrails pilot on Opus 4.7. Get refined. Then Mythos-class capability ships inside a Claude 5 or Opus 5 release. Output filters on the most dangerous security outputs. Most likely path to any consumer-facing access.

Scenario C: Forced release through competitive pressure (lower probability). If OpenAI or an open-source team reaches the same capability publicly, Anthropic's safety-first framing collapses. The case for holding back goes away.

Scenario D: Indefinite restriction (low probability but real). Mythos Preview stays locked. Future Claude versions pick up the capability with enough controls that "Mythos" as a standalone product never ships publicly. Glasswing becomes permanent, not a waypoint.

If you're planning for the business, Scenario B is the one to bet on. Mythos-class capability landing inside an Opus 5 release with guardrails. Late 2026 or early 2027.

All four scenarios are mapped out in detail in the interactive briefing, with the probability framing and the timing logic for each one.

---

What this means for you

If you're a $500k+ educator, consultant, or operator building with AI, here's what matters out of all of this.

One: The constraint has shifted

Six months ago, model capability was the bottleneck. People asked "which model is best?" because the answer mattered.

It doesn't any more. Opus 4.6 is already good enough to deliver serious value if you give it something to work with. Mythos will be better. Opus 5 will be better still. Each new model widens the gap between "good enough" and "step change".

But none of those models will know your business. They'll all be generic until you make them yours.

The constraint is now what you've built for them to run on. Your IP. Your method. Your frameworks. In a format any model can read and act on.

Two: The architecture matters more than the model

The Claude Code infrastructure (KAIROS, ULTRAPLAN, Coordinator Mode) is the more useful signal than the Mythos benchmarks. It's shipping now. It changes how AI systems actually work in production.

If you've already done the IP extraction work, you can plug it straight into the multi-agent setup Claude Code is building. Your frameworks become coordinator instructions. Your decision logic becomes worker prompts. Your delivery sequences become tool calls.

If you haven't done the extraction, the infrastructure is useless to you. Better tools, same empty input.

Three: Waiting for Mythos is the worst strategy

This is the bit most founders get wrong. They read about Mythos. Think "I'll wait for the better model". Put off the work that actually matters.

The founders who'll get value from Mythos when it ships are the ones who've already pulled out their IP, written their architecture files, built their multi-agent prompts, and tested them on Opus 4.6 or Opus 4.7. When Mythos opens up, they swap the model and immediately see the upgrade.

The founders who waited will still be opening ChatGPT. Pasting prompts. Wondering why AI "doesn't work for their business".

The work doesn't change. The model gets better. Either you compound on the upgrades or you start from scratch every time.

Four: Three practical actions

Action 1: Get your IP out of your head. Frameworks, decision trees, method, delivery sequences. Structured. Written down. Not in PowerPoints. In a format the machine can read. (Markdown is fine. Plain text is fine. The structure matters more than the file type.)

Action 2: Write your architecture file. Whatever model you're on, write a clear doc explaining how it should think about your work. Your principles. Your words. Your common patterns. Things to never do. This becomes your CLAUDE.md, your system prompt, your agent persona. Same artefact, multiple uses.

Action 3: Build a multi-agent prototype. Small scale is fine. One coordinator. Two or three workers with specific roles. Get a feel for how multi-agent flows work. Where they break. What they're good at. By the time Mythos-class kit is widely available, the team already running in that pattern is months ahead.

Two ways to take this further:

• Want the whole briefing on one scrollable page with the charts, the scenarios, and the action plan? Open the interactive guide. Free for the first three sections. Email to read the rest.
• Not sure where your business actually stands? Take the assessment. Five minutes. Shows exactly where the gaps are and what to build first.

---

The honest summary

Mythos exists. It's a real step up. The headline numbers are softer than reported. The infrastructure story matters more than the model story. Public access under the Mythos brand is unlikely. The capability will probably ship inside Opus 5 or Claude 5 in late 2026 or early 2027.

For anyone building with AI right now, the answer is the same as it was on March 27 when Fortune broke the original story.

Stop waiting for the model. Start building the architecture.

The founders who do that work compound on every model release. Mythos. Opus 5. Whatever comes after.

The ones waiting will still be at zero when the next leak drops.

Cheers.

---

Sources:

• Fortune: Anthropic confirms testing Mythos after data leak (March 26, 2026)
• Fortune: Mythos cybersecurity risk analysis (March 27, 2026)
• VentureBeat: Claude Code source code appears to have leaked (March 31, 2026)
• Anthropic: Project Glasswing announcement (April 7, 2026)
• Decode The Future: Claude Code source leak complete guide
• Bloomberg: Unauthorised Mythos access incident (April 22, 2026)
• Manifold Markets: Claude Mythos release date probabilities