Anthropic's Mythos model accessed by unauthorized users, report says
Anthropic has opened an investigation after discovering that a small group of users gained unauthorized access to the AI company's powerful new Mythos model, Bloomberg News reported on Tuesday.
The "small group of unauthorized users" was said to have accessed the advanced Mythos AI model the same day Anthropic began rolling out a preview of the model to a limited group of approved companies for testing in late February.
"We're investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments," Anthropic said in a statement.
With the model publicly introduced on April 7th, the incident is raising fresh concerns over how tightly the high-end cybersecurity tool is being controlled.
Anthropic has touted its Claude Mythos Preview model as "so powerful that it could enable dangerous cyberattacks," according to a person familiar with the matter and documentation reviewed by the media outlet.
The San Francisco-based company said there was no evidence the unauthorized access impacted any of Anthropic's systems or went beyond the third-party vendor's environment, Bloomberg reported.
Still, Anthropic has not publicly confirmed the full scope of the incident, and it remains unclear whether any vulnerabilities were identified or exploited by the unauthorized users.
Access traced to private online group
The users were said to be part of a private Discord forum that managed to gain entry despite the model being restricted to select organizations under the newly launched Project Glasswing initiative.
Project Glasswing - limited to 40 technology and infrastructure organizations, including Amazon, Google, Microsoft, Apple, and Cisco - has granted those companies permission to test Mythos' extraordinary vulnerability-detection mechanisms and autonomous security patching on their own systems.
According to the person familiar with the matter, the users "relied on a mix of tactics" to break into the system, but there was no direct breach of Anthropic's core systems.
The Discord channel at the center of the incident is alleged to focus on finding information about unreleased models, often using bots to scour the internet, including sites like GitHub, for details that AI companies and industry insiders have posted online.
One method of access was via a single worker at the unnamed third-party contractor used by Anthropic, while another tactic included "trying commonly used internet sleuthing tools often employed by cybersecurity researchers," the person told Bloomberg.
Built to find and exploit vulnerabilities
The Mythos rollout has already drawn scrutiny from regulators and policymakers, after internal testing (and external evaluations) have shown the model can uncover serious flaws in operating systems, browsers, and other foundational software.
This has triggered warnings across the board that the frontier model could be misused to accelerate cyberattacks or expose critical weaknesses in widely used systems.
Anthropic itself has categorized Mythos as being "too dangerous" for public consumption, and has sparked fears after its preview model had uncovered "thousands" of major vulnerabilities and zero days in "every major operating system and web browser."
Security experts are also warning that the advanced AI tool - capable of autonomously identifying and exploiting vulnerabilities within just a matter of hours - could easily outpace existing cybersecurity defenses.
Anthropic has been slowly expanding its availability to not only select corporate entities but also government users, including financial institutions and US federal agencies, prompting the Trump administration to call a meeting with Anthropic's CEO, Dario Amodei, to discuss its own blacklist of the AI start-up.
Earlier on Tuesday, financial regulators across Australia and South Korea raised concerns about the AI model, arguing it could destabilize entire banking systems, joining earlier warnings from regulators in several EU nations.