![\"Claude](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/04\/1776957261_347_0x0.jpg\")
<\/p>\n<\/p>\n
Hacker Claude Mythos (Photo by Jakub Porzycki\/NurPhoto via Getty Images)<\/p>\n
NurPhoto via Getty Images<\/p>\n
An unauthorized group of users gained access to Anthropic\u2019s Claude Mythos model on the same day it was announced, according to a Bloomberg report released Tuesday. The users are said to be part of an online Discord group that searches for information about unreleased AI models.<\/p>\n
The report says that one of the users had privileged access as a worker at a third-party contractor to Anthropic. <\/p>\n
I requested comment from Anthropic on the incident, and a spokesperson responded via email that \u201cwe\u2019re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments.\u201d The company also noted there was no evidence at this time that the reported activity extended beyond the third-party vendor environment or that Anthropic systems are affected. <\/p>\n
In any case, this alleged incident highlights the risk of frontier AI models being targeted by unauthorized actors. While Bloomberg notes the users don\u2019t appear to have been malicious, if powerful models like Mythos were to fall into the hands of a cyber gang or nation-state, there could be serious security complications for enterprises. <\/p>\n
Frontier AI Companies Need Frontier Security <\/p>\n
The news comes just two weeks after Anthropic announced<\/a> Claude Mythos Preview and Project Glasswing<\/a>, a program that offered access to organizations involved in building or maintaining critical software. Greenwing made a big deal of controlling access to this powerful new model and the idea that a group of users could sidestep these controls and access the model anyway would raise serious questions about Anthropic\u2019s security controls.<\/p>\n It\u2019s worth noting that news of Mythos first went public in a data leak<\/a>, when descriptions of the model were stored in a publicly accessible data cache. The company also accidentally released part of the source code for its AI-powered assistant, Claude Code,<\/a> due to \u201chuman error.\u201d<\/p>\n Taken together, these incidents suggest that organizations can\u2019t rely on frontier AI companies to restrict access to their most powerful models. Frontier AI companies are just as susceptible to human error and breaches as any other vendor, and given the offensive vulnerability discovery potential of Mythos, organizations need to become much faster at discovering and patching vulnerabilities.<\/p>\n \u201cThe Mythos incident is a warning that the biggest risk with advanced AI systems isn\u2019t just model capability, it\u2019s access control around the humans, vendors and systems that surround it. The minute a restricted AI system can be reached through a third-party pathway, you\u2019re no longer dealing with an AI safety issue alone, you\u2019re dealing with a systemic security failure that spans identity, supply chain and infrastructure,\u201d John Paul Cunningham, CISO at identity security vendor Silverfort, told me via email. <\/p>\n \u201cAI won\u2019t need to \u2018break in\u2019 if it can inherit access through poorly governed identities, over-trusted integrations or weak vendor controls. But the real risk isn\u2019t just how access is gained; it\u2019s what the system is allowed to do once it has it. These systems need strong guardrails that explicitly define their lane: what they can access, what actions they can take and where those permissions must stop,\u201d Cunningham said. <\/p>\n Cunningham said that powerful AI systems like Mythos must be secured like critical infrastructure, with continuous identity verification and strong runtime enforcement over what they can access and execute, so that access doesn\u2019t automatically translate into unrestricted action. <\/p>\n Enterprises Need To Up Their Game Following Mythos<\/p>\n The drama surrounding Mythos highlights that enterprises can\u2019t count on frontier AI companies to control risk. The moment models like Mythos or even GPT-5.4 Cyber<\/a> are announced, defenders need to begin preparing to address the next generation of threats. It\u2019s not just a question of these models being leaked to bad actors, but other providers developing models with similar capabilities that introduce new threats. <\/p>\n \u201cThere has been significant attention following reporting that Anthropic is investigating unauthorized access to Mythos, an AI system capable of identifying critical software vulnerabilities. While the investigation focuses on access and controls, the broader security implications are more important\u2014and predictable,\u201d Nicole Carignan, senior vice president, security and AI strategy and Field CISO at AI security firm Darktrace, told me via email. <\/p>\n \u201cThis highlights the continued weaponization of commercial tooling. Frontier and near\u2011frontier models are increasingly dual\u2011use by default. Capabilities designed to improve software quality and security can be repurposed with minimal friction to accelerate vulnerability discovery for malicious ends. This is not a failure of intent; it is an outcome of scale, accessibility and capability diffusion,\u201d Carignan said. <\/p>\n Carignan says that these models will continue to be a target for threat actors who can exploit them to gain initial access to other organizations. Given that many critical vulnerabilities are not yet publicly known, access to models like Mythos can enable threat actors to exploit \u201cunknown\u201d vulnerabilities and enter a company\u2019s internal environment.<\/p>\n From this perspective, security teams must assume that advanced vulnerability discoveries will continue to proliferate, as the window between discovery and exploitation continues to shrink. While it appeared that Project Glasswing might offer a grace period for the security community to come to terms with the risks of next-generation frontier AI models, this alleged breach suggests more immediate action could be required.<\/p>\n Time To Compromise <\/p>\n The most immediate risk is the contraction of time to exploitation. Models like Mythos give threat actors the capability to discover vulnerabilities faster than defenders can patch them, lowering the overall time-to-compromise. <\/p>\n \u201cThis isn\u2019t a theoretical future risk. The wave is already forming offshore, and most organizations are still debating whether to build a seawall. AI hasn\u2019t just made attackers faster, it has fundamentally changed the economics of exploitation,” Adam Arellano, Field CTO of AI DevOps company Harness, valued<\/a> at $5.5 billion, told me via email.<\/p>\n “What once required a skilled threat actor, weeks of reconnaissance, and significant resources can now be automated, scaled, and deployed by someone with a capable model and a motivated prompt. Zero-day vulnerabilities that previously had a window of days or weeks before widespread exploitation are now being weaponized in hours. The asymmetry between attack and defense has never been more extreme,\u201d Arellano said. <\/p>\n While the exposure presented by tools like Mythos and GPT-5.4-Cyber is limited, the situation is changing fast. Security leaders can\u2019t afford to rely on frontier AI vendors to contain the risks of these powerful models. Now more than ever, organizations need to develop the ability to identify and remediate vulnerabilities at machine speed. <\/p>\n","protected":false},"excerpt":{"rendered":"Hacker Claude Mythos (Photo by Jakub Porzycki\/NurPhoto via Getty Images) NurPhoto via Getty Images An unauthorized group of…\n","protected":false},"author":2,"featured_media":14225,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[24,53,3154,182,2213,314],"class_list":{"0":"post-14224","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-anthropic","8":"tag-ai","9":"tag-anthropic","10":"tag-anthropic-claude","11":"tag-claude","12":"tag-claude-mythos","13":"tag-security"},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/14224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=14224"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/14224\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/14225"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=14224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=14224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=14224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}