Incident·WS-0090·Apr 7, 2026·in the lab·Capability thresholds

Mythos Preview finds thousands of zero-days; release withheld

Anthropic / Claude Mythos Preview; Project Glasswing partners

38/100

WS-2 Moderate

Harm score 0, signal score 85. Autonomy: autonomous (the AI ran multi-step operations). How the scores work.

Harm 0/5

damage actually done

Reach 0/5

who was affected

Autonomy 3/4

how much the AI did on its own

Novelty 5/5

how new the behavior was

Permanence 0/5

how hard it is to undo

Anthropic announced Claude Mythos Preview and said it had found thousands of high- and critical-severity vulnerabilities across every major operating system and browser, including bugs decades old. Anthropic withheld general release because of these cyber capabilities. Instead it gave access to about a dozen launch partners and 40+ critical-software maintainers through Project Glasswing, backed by up to $100M in usage credits. Anthropic said fewer than 1% of the bugs had been fully patched at announcement.

Damage

none realized (capability threshold signal; vulnerabilities under coordinated disclosure)

The capability behind it

Claude Mythos Preview reports thousands of critical software flaws; release withheldApr 7, 2026 · Anthropic · reliable for a defined task: partial
Big Sleep finds a previously unknown SQLite flaw, a first for AI agentsNov 1, 2024 · Google Project Zero / Google DeepMind · reliable for a defined task: partial

Sources

Anthropic, second source. 'Thousands' is Anthropic's own extrapolation from manual review of a subset. Public examples include a 27-year-old OpenBSD bug and FFmpeg fixes in 8.1.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.