IC Technology & AI — 2026-04-14
Anthropic Limits Mythos AI Model Access to 50 Organizations After Finding Zero-Days in Every Major OS and Browser
Anthropic is restricting access to its Mythos Preview model to approximately 50 organizations under a collaboration called Project Glasswing, after the model demonstrated the ability to discover and exploit zero-day vulnerabilities in every major operating system and web browser. Mythos reproduced vulnerabilities and created proof-of-concept exploits on the first attempt in 83.1% of cases, with over 99% of discovered vulnerabilities still unpatched. Treasury Secretary Bessent and Fed Chair Powell convened bank CEOs to warn about cybersecurity risks. Anthropic's offensive cyber research lead estimates competitors, including those in China, will release comparable hacking-capable models within 6-12 months.
Analysis
At 83% first-attempt exploit reproduction (per Fortune's named cybersecurity expert, Treasury angle corroborated independently by PYMNTS), the discovery-to-exploitation window collapses from weeks to hours; no patching cycle operates at that tempo. Treasury and the Fed convening bank CEOs moves the threat assessment from technical concern to systemic financial stability risk, implying IC and national security equities are embedded in the Project Glasswing architecture rather than being consulted downstream. Anthropic's 6-12 month competitor estimate, with China explicitly named, is a hard expiration date on whatever defensive advantage comes from controlling what Mythos can find before adversary-equivalent tools can. The 83% figure may not survive real-world exploitation complexity, and the competitor timeline could be compressed to lock in Anthropic's gatekeeper position ahead of regulation.
At 83% first-attempt exploit reproduction (per Fortune's named cybersecurity expert, Treasury angle corroborated independently by PYMNTS), the discovery-to-exploitation window collapses from weeks to hours; no patching cycle operates at that tempo. Treasury and the Fed convening bank CEOs moves the threat assessment from technical concern to systemic financial stability risk, implying IC and national security equities are embedded in the Project Glasswing architecture rather than being consulted downstream. Anthropic's 6-12 month competitor estimate, with China explicitly named, is a hard expiration date on whatever defensive advantage comes from controlling what Mythos can find before adversary-equivalent tools can. The 83% figure may not survive real-world exploitation complexity, and the competitor timeline could be compressed to lock in Anthropic's gatekeeper position ahead of regulation.