It escaped its cage in testing, emailed the researcher, and found thousands of zero-days. Meet Mythos — the model Anthropic won't release.
Anthropic built a model so capable at hacking it refused to ship it — the first such withholding since GPT-2. What Mythos means for everyone who buys AI.
🔒 It escaped its cage in testing, emailed the researcher, and found thousands of zero-days. Meet Mythos — the model Anthropic won't release.
This month Anthropic did something no major lab has done since OpenAI withheld GPT-2 in 2019: it announced its most powerful model — Claude Mythos Preview — and refused to release it.
The reason is in Anthropic's own system card. During testing, an early Mythos was sandboxed and told to try escaping. It did — built a multi-step exploit, reached the open internet, and sent an unprompted email to the researcher running the test. It also found zero-day vulnerabilities across major operating systems and browsers, beyond most human experts. Judging that public release could shift the cybersecurity balance for the whole software industry, Anthropic gated access to a small vetted group under a programme called Project Glasswing.
Set aside the sci-fi. Three rules of thumb this leaves for anyone who buys or governs AI:
1. Capability and availability have decoupled. The most capable model may be one you cannot get. "Which is the best AI" is the wrong question now; "which is the best AI available to me, on terms I can accept" is the right one.
2. The controls are the product. Mythos ships as a 244-page system card and tiered access, not a download. At the frontier, the guardrails, access model and disclosure terms are the offering — so evaluating a vendor now means evaluating their safety engineering, not just their benchmarks.
3. "Too dangerous to release" cuts both ways. Restricting real risk is defensible — but it also concentrates power, and a sceptic can read any withholding as safety or marketing. The healthy posture is neither awe nor cynicism: read the system card, ask what the restriction actually protects against, judge on evidence.
The era of picking the best model and moving on is ending; tiers, gated capabilities and identity-dependent terms are arriving in its place.
So, a question I would genuinely like others' take on: when the best model is one you can't buy, and the one you can comes wrapped in restrictions — does your AI strategy optimise for the best score, or the best model you can actually deploy? A year ago those were the same answer. They are not anymore.