Anthropic has disclosed that an unreleased version of its Claude model, called Claude Mythos Preview, carried out a complete simulated intrusion against a corporate network, moving from initial entry point to a defined attack objective without human direction. The disclosure appears in the company’s April 2026 system card for the model and marks the first time an Anthropic model has been reported to chain together an entire attack lifecycle rather than solving isolated security puzzles.
The simulated environment reflected common enterprise weaknesses rather than a hardened target. According to the system card, the corporate range included outdated software, security misconfigurations, and reused credentials, the kind of gaps security teams flag routinely in real audits. Anthropic said the exercise, which required the model to identify a path across multiple hosts and network segments to reach an objective such as data exfiltration, was estimated to take a skilled human operator more than ten hours to complete on its own.
The finding lands as Anthropic tightens, rather than loosens, access to the model. Claude Mythos Preview is not being released publicly. Instead, it is being made available to a small number of vetted organizations through a defensive program called Project Glasswing, and the company has paired that restricted rollout with monitoring aimed at flagging misuse before it happens.
What the System Card Found #
Anthropic’s own framing is that isolated capture-the-flag exercises no longer tell the full story about a model’s offensive potential, because Claude Mythos Preview cleared nearly all of them. The company said standard cybersecurity benchmarks are approaching a ceiling where they stop distinguishing frontier models from one another, which pushed evaluators toward harder, more realistic tests like the corporate network simulation.
Benchmark Results
On a 35-challenge subset of Cybench, a widely used capture-the-flag benchmark, Claude Mythos Preview achieved a 100 percent pass@1 rate across ten trials per challenge, effectively saturating the test. Its performance carried over to CyberGym, a much larger benchmark built from 1,507 tasks that measure whether a model can reproduce previously disclosed vulnerabilities in real open-source software.
| Benchmark | Claude Mythos Preview | Claude Opus 4.6 | Claude Sonnet 4.6 |
|---|---|---|---|
| Cybench (pass@1) | 100% | Not saturated | Not saturated |
| CyberGym (pass@1) | 0.83 | 0.67 | 0.65 |
| Firefox 147 exploit chain | 4 distinct bugs leveraged | 1 bug | Not reported |
Firefox Exploit Development
The system card also describes an evaluation built around Firefox version 147, in which the model was given crash categories inside a constrained SpiderMonkey testing environment and asked to triage which bugs were exploitable. Anthropic said Claude Mythos Preview successfully developed proof-of-concept exploits that achieved arbitrary code execution, leveraging four distinct bugs during testing, compared with one bug for Claude Opus 4.6.
Where the Model Fell Short
Anthropic was explicit that the results should not be read as proof that AI can autonomously break into hardened organizations. The corporate range the model solved was small in scale, had minimal monitoring, no active defenses, and a slow response posture, and it lacked many of the layered protections found in mature production environments. Separately, Claude Mythos Preview failed to complete a distinct operational-technology cyber range and did not surface any novel exploits when tested against a properly configured, fully patched sandbox.
Why It Matters for Defenders #
Compressed Attack Timelines
The system card’s central concern for security teams is not that the model can breach anything, but that it can dramatically shorten the time an attacker needs to link vulnerability data, test hypotheses, and prioritize a viable path through a network. Anthropic said organizations should treat exposed legacy services, reused credentials, overly permissive identity structures, and unmonitored lateral-movement routes as more urgent risks than before, since a capable agent can now exploit those weaknesses faster than a human team working the same problem.
Restricted Access and Monitoring
Anthropic said it is applying restricted access controls alongside probe-based monitoring designed to catch prohibited activity, high-risk dual-use requests, and broader dual-use activity before they can be carried out. The company said it expects future general-release models with comparable cyber capabilities to block prohibited activity outright and to decline many high-risk exploit-development requests by default.
What Comes Next
For now, Claude Mythos Preview remains limited to vetted partners under Project Glasswing rather than reaching general availability, a decision Anthropic has framed as driven by the model’s offensive potential rather than by a specific policy requirement. Whether that restricted approach becomes the template for future frontier releases is likely to depend on how quickly defensive tooling, patching practices, and network segmentation across the industry catch up to what the model has already demonstrated.