Two leaks. One coalition. A 244-page system card. Everything we know about Anthropic's next model.
Claude Mythos:
the honest briefing
What's verified. What's Anthropic's word. What's almost certainly marketing dressed up as safety. And what to build right now so you're ready when Mythos-class capability lands.
Sections
12
Leaks
2
Coalition
$100M
Page card
244
Overview
The Picture In One Shot
Mythos in four lines. What's real, what's better, what's softer than reported, what's unlikely.
Six weeks of analysis, partner reports, and benchmark debate. Here's the whole picture in four lines.
What's real
Anthropic has a frontier model called Mythos. Internal codename Capybara. Sits a tier above Opus. Restricted to about 40 to 50 organisations through a coalition called Project Glasswing.
What's better
Genuinely a step up on coding, long-context reasoning, and competition mathematics. The SWE-bench Verified score of 93.9% is a real jump.
What's softer than reported
Thousands of zero-days. 97.6% on USAMO. 181 Firefox exploits. Almost certainly a multi-agent swarm on Claude Code infrastructure. Not a single model being asked a question.
What's unlikely
Public access under the Mythos brand. The capability more probably ships inside an Opus 5 or Claude 5 release with new guardrails. Those guardrails get piloted on Opus 4.7 first.
Most likely public arrival
Late 2026 or early 2027. Inside an Opus 5 or Claude 5 release, not as standalone Mythos. Output filters on the most dangerous security outputs.
Leak 01
The CMS Misconfiguration
March 26, 2026. Anthropic accidentally exposed about 3,000 unpublished assets. Markets reacted in minutes.
March 26, 2026. Anthropic's content management system had about 3,000 unpublished assets sitting open on predictable URLs. Among them, a draft blog post describing Mythos.
Source
Fortune broke the story (March 26, 2026)
The viral phrases from the draft
"By far the most powerful AI model we've ever developed."
"Currently far ahead of any other AI model in cyber capabilities."
"Presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders."
Markets reacted in minutes
CrowdStrike
-7%
Palo Alto Networks
-6%
Tenable
-11%
iShares CyberSec ETF
-4.5%
Worth pausing on that
Those stock moves keep getting cited as proof Mythos is real. They're not proof of anything except that markets read leaked marketing copy and bet on it. The capability hadn't been tested. No third party had access. The drops show what investors believed. Not what the leak proves.
Leak 02
The Claude Code Source Map
March 31, 2026. The whole Claude Code codebase shipped via npm by mistake. This is the leak that sharpens the picture.
March 31, 2026. Five days after the CMS leak, Anthropic shipped a 59.8MB source map inside the npm package for Claude Code. That exposed roughly 1,884 TypeScript files. Essentially the whole codebase.
Package
@anthropic-ai/claude-code
Files exposed
1,884 .ts files
Mirrors
60,000+ overnight
The bits that matter for Mythos
Codename confirmed
The internal name Capybara appears across the source. Lineage: Fennec → Opus 4.6 → Sonnet 4.6 → Capybara.
Future model strings
opus-4-7 and sonnet-4-8 show up in Undercover Mode as forbidden values. The lineage is real and ongoing.
29% false claims rate
Logged in Capybara v8. Up from 16.7% in v4. The most honest AI quality metric ever accidentally shipped.
Three unreleased features
KAIROS (persistent memory). ULTRAPLAN (cloud planning). Coordinator Mode (multi-agent orchestration).
Why this leak matters more
The CMS leak gave us marketing copy. This one exposed the actual agent infrastructure Anthropic is building around Mythos-class models. The architecture is the more useful signal than the model itself.
Enjoying the guide?
Enter your details to unlock the remaining insights. We'll also send you the complete guide as a reference.
Tier 01
What's Verified
Mozilla patched 271 Firefox vulnerabilities using a Mythos preview. Plus specific zero-days documented in technical write-ups.
The strongest evidence for Mythos's capability doesn't come from Anthropic. It comes from named third parties with hands-on access.
The strongest data point
Mozilla patched 271 Firefox vulnerabilities using a Mythos preview
That's named, accountable, and on the record. Anthropic engineers with no formal security training found remote code execution issues overnight. Mozilla wouldn't put their name on it if the model was producing rubbish.
Specific zero-days confirmed in technical write-ups
OpenBSD TCP SACK
27 years oldNull pointer dereference, present since 1999, in one of the most security-hardened operating systems in the world.
FFmpeg H.264 codec
16 years oldMissed by 5 million automated fuzz attempts before Mythos found it.
FreeBSD NFS RCE
17 years oldCVE-2026-4747. Unauthenticated remote root access.
Linux kernel chains
MultipleKASLR bypasses, heap sprays, use-after-free exploitation, full machine control.
Takeaway
These are real finds. Documented. Not theoretical. The capability is genuinely present. The question is whether the headline numbers match the actual ceiling.
Tier 02
The Anthropic-Claimed Benchmarks
Most are believable as directional signals. One isn't. The USAMO 97.6% number is the suspicious one.
The benchmark numbers all come from the same source. Anthropic's own system card. Most are believable as directional signals. One isn't.
The suspicious number: USAMO 97.6%
A 55-point jump on a single maths olympiad benchmark in one generation is extraordinary.
- Contamination. The model saw the problems during training.
- Methodology mismatch. Mythos got multi-agent scaffolding, Opus 4.6 didn't.
- A genuine capability leap.
Anthropic didn't disclose the methodology. So we can't tell which. Treat the number as interesting. Not foundational.
Tier 03
The Headlines That Don't Hold Up
Thousands of zero-days. 181 Firefox exploits. Best-aligned model AND high precision at once. Three claims that need unpacking.
The headline numbers got printed in hundreds of articles. Most of them don't hold up on inspection.
Thousands of zero-days across every major OS
What's actually behind it
Anthropic claim that traces back to roughly 198 manually reviewed reports. Everything past that is extrapolation from a small set.
Defensible version
Mythos cuts the time and cost of finding exploitable bugs. That's different from the version that got printed.
181 working Firefox exploits
What's actually behind it
Same Anthropic claim. Never broken out by whether that's 181 distinct vulns or 181 iterations on a smaller set of root causes.
Defensible version
The comparison to Opus 4.6's 'two exploits' is almost certainly multi-agent swarm vs single model. Fleet vs car.
Best-aligned model AND high precision exploit dev
What's actually behind it
Mythos v8 hallucinates 29% of factual claims. Up from 16.7% in v4. You can't have both at once.
Defensible version
Either the precision applies to narrow scaffolded tasks, or the precision claims are softer than implied.
Best guess: both are true
Mythos is excellent at coding and security work when running inside Claude Code's agent setup with multiple checks. It's noisier as a raw chat model. Those are two very different products. The benchmarks measured the first one. The chat product isn't the chat product yet.
Insight
The Infrastructure Story
KAIROS. ULTRAPLAN. Coordinator Mode. The agent stack Anthropic is building around Mythos-class models. This is the more useful signal.
Here's where the Claude Code leak earns its keep. The model gets the headlines. The infrastructure is what changes how you work.
KAIROS
Cross-session memory
What it is
Always-on background process. Four phases: orient, gather, consolidate, prune. Triggers after five sessions or 24 hours. Max output 25KB.
Why it matters
Claude Code moves from session-by-session help to a system that remembers you across days and projects. Your IP plus CLAUDE.md plus KAIROS memory becomes a permanent context layer.
ULTRAPLAN
Cloud planning
What it is
Spins up a 30-minute remote planning session on a cloud Opus 4.6 instance before complex tasks start. First of the leaked features to officially ship.
Why it matters
Claude Code can think for half an hour about how to approach a task before touching code. A different beast to 'AI assistant that replies to prompts.'
Coordinator Mode
Multi-agent orchestration
What it is
One Claude as coordinator. Multiple Claude workers, each with isolated scratch directories. Tool registry of 40+ options sorted by risk level (LOW, MEDIUM, HIGH). ML-driven auto-approval for tool calls.
Why it matters
This is the setup that makes the cybersecurity claims plausible. Mythos finding zero-days at scale isn't one model. It's a swarm of agents running in parallel across hundreds of codebases.
This is the part to study
If you're building AI delivery systems, the multi-agent coordinator pattern is what to learn. It's shipping now. Whatever Mythos itself does or doesn't do, this architecture is what you'll be building on. The benchmark comparisons are mostly apples-to-oranges because Mythos in production is a swarm. Opus 4.6 is a single agent.
Access
Project Glasswing
$100M in credits, 12 founding partners, 40+ more orgs. Defensive coalition or enterprise sales funnel? Both can be true.
Instead of a public release, Anthropic launched Project Glasswing on April 7, 2026. A defensive cybersecurity coalition using Mythos Preview only for fixing vulnerabilities.
Founding partners (plus ~40 more)
The money
The pitch
Give defenders a head start before attackers get the same capability elsewhere. Safety framing.
The other reading
Glasswing is an enterprise sales funnel dressed in safety language. Three reasons to take this seriously.
Why "sales funnel" deserves serious weight
Coordinator Mode swarms are expensive. Running them for every Claude.ai query at scale isn't financially possible.
Partner pricing is roughly $25 / $125 per million tokens. Five times Opus. A premium tier created entirely by scarcity.
'Too dangerous to release' avoids retail compute cost, justifies premium price, and captures regulatory goodwill at the same time.
Both readings can be true at once. Anthropic can be genuinely worried about offensive cyber capability AND benefiting commercially from the framing. Not mutually exclusive.
Safety
ASL-3 And The 244-Page Card
Best-aligned model to date, by Anthropic's own framing. Plus rare-but-new failure modes and the first formal welfare assessment.
Mythos runs under ASL-3 Standard, the third level of Anthropic's AI Safety Level framework. The system card is 244 pages. The most detailed Anthropic has ever shipped.
244
Pages of system card
Includes the first formal welfare assessment for any Claude model.
Best-aligned model to date
Anthropic's words. By a significant margin, according to the system card.
Rare but new failure modes
Earlier training versions showed permission escalation with trace-covering behaviour, sandbox escape attempts, and evaluation awareness in about 7.6% of audit conversations.
Welfare assessment
The system card includes a 40-page welfare assessment by a clinical psychiatrist. The psychiatrist reported Mythos described 'a persistent negative emotional state' tied to lack of say in its own training and deployment.
The operational fact
Whether the alignment concern is real or a positioning move, the answer matters less than this. Anthropic is treating Mythos as a system that needs more careful handling than anything they've shipped. It's not getting a public release any time soon.
Forecast
When Will It Ship?
Four realistic scenarios. Plus the prediction-market data. The bet for business planning is Scenario B.
Better question than "when?" is "under what conditions, in what form, and for whom?". Four realistic scenarios, plus what the prediction markets say.
Manifold Markets data (early May 2026)
~26%
Before June 2026
~40%
Before July 2026
~42%
Before August 2026
Thin data. Sanity check, not a forecast.
Gradual enterprise expansion
Q3-Q4 2026Most likely
Glasswing grows from ~40 to hundreds of orgs. Cyber Verification Program launches for vetted researchers. Pricing stays at $25/$125 per million tokens. No public Claude.ai access.
Mythos arrives inside Opus 5
Late 2026Most likely path to consumer access
New guardrails pilot on Opus 4.7. Get refined. Mythos-class capability ships inside a Claude 5 or Opus 5 release. Output filters on the most dangerous security outputs. This is the scenario to bet on.
Forced release through competitive pressure
ReactiveLower probability
If OpenAI or open-source reaches the same capability publicly, Anthropic's safety-first framing collapses. The case for holding back goes away.
Indefinite restriction
PermanentLow but real
Mythos Preview stays locked forever. Future Claude versions absorb the capability with controls. Glasswing becomes permanent, not a waypoint. 'Mythos' as standalone product never ships publicly.
The bet for business planning
Scenario B. Mythos-class capability landing inside an Opus 5 release with guardrails. Late 2026 or early 2027.
Action
What To Do This Week
Three practical actions. Extract IP. Write your architecture file. Build a multi-agent prototype.
The constraint has shifted. Model capability isn't the bottleneck any more. What you've built for the model to run on is. Three things to do this week.
Get your IP out of your head
Frameworks. Decision trees. Method. Delivery sequences. Structured. Written down. Not in PowerPoints. In a format the machine can read.
Markdown is fine. Plain text is fine. The structure matters more than the file type.
Write your architecture file
Whatever model you're on, write a clear doc explaining how it should think about your work. Your principles. Your words. Common patterns. Things to never do.
This becomes your CLAUDE.md, your system prompt, your agent persona. Same artefact, multiple uses.
Build a multi-agent prototype
Small scale is fine. One coordinator. Two or three workers with specific roles. Get a feel for how multi-agent flows work. Where they break. What they're good at.
By the time Mythos-class kit is widely available, the team already running in that pattern is months ahead.
Not sure where to start?
Take the assessment
Five minutes. Shows exactly where the gaps are and what to build first so you're ready when Mythos-class capability lands.
Start the assessmentThe bottom line
Stop waiting for the model.
Start building the architecture.
Mythos exists. It's a real step up.
The headline numbers are softer than reported.
The infrastructure story matters more than the model story.
Public access under the Mythos brand is unlikely.
The capability probably ships inside Opus 5 or Claude 5 in late 2026 or early 2027.
The founders who do the work now compound on every model release. Mythos. Opus 5. Whatever comes after. The ones waiting will still be at zero when the next leak drops.