Anthropic's Mythos: The End of Security by Obscurity

For a while, I thought AI was mostly a productivity story. Faster emails, cleaner code, fewer meetings where someone reads bullet points aloud. Useful, sure. World-changing? Jury's still deliberating.

Then Anthropic dropped something called Mythos, and I'm starting to think we've been arguing about the appetizer while the main course just arrived unannounced.

If last week the Anthropic team dropped the ball by accidentally releasing part of Claude's source code, this week... they seem to be compensating for this blunder with a new model announcement. But... you can't try it!

What? An AI product announcement with no access to the product? That's right... apparently it's too powerful to release to the public!

Here's what happened. Anthropic announced a model (Claude Mythos Preview) that won't be getting a public release anytime soon. Instead, it's being quietly handed to a gated group of heavy hitters: Amazon, Apple, Google, Microsoft, Nvidia, CrowdStrike, Cisco, Palo Alto Networks, and the Linux Foundation, under a program called Project Glasswing.

The stated mission is defensive cybersecurity. The unstated subtext is: this thing is powerful enough that we're not sure we should just put it on the internet.

"This model is good at finding vulnerabilities that would be well understood and findable by security researchers. At the same time, it has found vulnerabilities, and in some cases crafted exploits, sophisticated enough that they were both missed by literally decades of security researchers, as well as all the automated tools designed to find them." -- Logan Graham, the head of an Anthropic tester team

Mythos, apparently, has already found thousands of previously unknown security bugs (what the security world calls zero-days) across major operating systems and browsers. It can identify them and... exploit them.

That's not a product launch. That's a flare gun going off... or very clever marketing campaign... or both at the same time.