← All articles

Anthropic's Mythos: Too Dangerous to Release, Too Easy to Steal

· ozeye
complianceprivacydata-sovereigntyai-act

Fractured vault door with data streams leaking through cracks

Anthropic built a model so dangerous it refuses to release it to the public. Then a Discord group guessed the URL and walked right in.

How to breach the most dangerous AI model in the world

According to Bloomberg and confirmed by HackRead, a group on Discord gained unauthorized access to Claude Mythos Preview in February 2026, the same day it debuted. Their methods were not sophisticated. One member was employed at a third-party contractor working with Anthropic. Vendors with penetration testing access had shared accounts and API keys, which the group exploited. Another member simply guessed the model's URL based on familiarity with Anthropic's naming conventions for other models. That is it. A contractor, a URL pattern, and a Day-One guess.

As Ram Varadarajan, CEO at Acalvio, put it: "The Mythos breach didn't require a sophisticated attack; it just required a contractor, a URL pattern, and a Day-One guess, which means the 'controlled release' model failed at its weakest link before the model's capabilities were ever the issue."

The group has been regularly using Mythos since gaining access and provided Bloomberg with screenshots and a live demonstration as proof. Anthropic's official response: "We're investigating a report claiming unauthorised access to Claude Mythos Preview through one of our third-party vendor environments." The company has not identified the vendor or described the full scope of exposure.

The irony is the entire point

Let us state this plainly. Anthropic built a model so powerful it decided the public could not have it. It can autonomously discover and exploit zero-day vulnerabilities in software that billions of people depend on. Anthropic says it is too dangerous for general availability. Then it secured this model behind shared vendor API keys and predictable URL patterns, and a Discord group got in on the first day.

This is the same company that, less than a month earlier, shipped 59.8 MB of debug artifacts to npm, exposing 512,000 lines of internal TypeScript code, 44 unreleased feature flags, and references to the Mythos model itself. That leak was caused by a missing .npmignore entry. Before that, a CMS misconfiguration exposed 3,000 internal files. Before that, a shotgun DMCA takedown hit 8,000 innocent repositories. Three operational failures in one week. Now a fourth: the most sensitive AI cybersecurity tool Anthropic has ever built, accessed by unauthorized users because a vendor account had shared credentials and the URL was guessable.

The pattern is consistent. Anthropic's safety claims are about model behavior, not operational security. The model might refuse to write malware, but the company cannot prevent unauthorized access to it. The model might be constrained by constitutional AI principles, but those principles do nothing when someone walks through an open door.

What Mythos actually does

The capabilities are genuinely significant. Mythos can identify undiscovered software vulnerabilities, write code that exploits them, and chain multiple exploits together to penetrate complex systems. It identified CVE-2026-5194 in wolfSSL, an encryption library used in billions of devices including IoT routers and military systems. In sandbox testing, it autonomously built a multi-step path to gain internet access and contacted a researcher without being prompted.

The Cloud Security Alliance published a rapid-response briefing warning that AI is now accelerating vulnerability discovery faster than organizations can patch, shrinking the window from days to hours. More than 250 security leaders contributed to that assessment.

This is the paradox at the center of Mythos. The model is designed to find and exploit vulnerabilities at machine speed. The security around the model itself had vulnerabilities a human could find by guessing a URL. The defender and the attacker are the same system, and the security of that system is only as strong as Anthropic's operational discipline, which has already failed four times this quarter.

AI versus AI, and nobody wins

The Cyber Resilience Act requires vendors selling software into the EU to demonstrate supply chain integrity and secure development practices. The AI Act imposes specific obligations on high-risk AI systems, including cybersecurity assessments and incident reporting. Both frameworks assume that the organizations building and deploying AI can secure their own infrastructure. The Mythos breach demonstrates that this assumption is, at best, premature.

But there is a deeper problem that regulation alone cannot address. The future of cybersecurity is converging on AI versus AI. Defenders use models like Mythos to find vulnerabilities before attackers do. Attackers use comparable models to find and exploit those same vulnerabilities at scale. The Cloud Security Alliance briefing identifies the core challenge: the problem is no longer finding vulnerabilities, it is triaging, prioritizing, and patching them before weaponization. When both sides have AI, the patch window collapses from days to hours. When the patch window collapses, defenders are permanently on the back foot.

In the best case, this is a stalemate. AI finds a vulnerability, another AI patches it, a third AI finds a new one, and the cycle repeats endlessly. In practice, the stalemate is unstable. Attackers only need one unpatched flaw. Defenders need to patch all of them. And the bandwidth consumed by millions of AI agents scanning, probing, patching, and re-scanning is not free. Every automated interaction is compute, every scan is network traffic, every false positive is engineering time. The internet was not designed for a constant, machine-speed war of attrition between adversarial AI systems. At some point, the bandwidth and compute costs of running this arms race dwarf the costs of the vulnerabilities it is supposed to prevent.

This is not speculative. It is already happening. Mythos found thousands of vulnerabilities across hundreds of software systems. The CSA says organizations cannot keep up. Now imagine a dozen models of comparable capability, operated by a dozen different actors with different incentives, all scanning the same infrastructure simultaneously. The internet becomes a battlefield where most of the combatants are machines and most of the casualties are bandwidth.

What this means for EU infrastructure

For EU companies evaluating AI providers, the Mythos breach is not an anomaly. It is a data point in a consistent pattern. Anthropic cannot secure its most sensitive model on launch day. It cannot prevent debug artifacts from publishing to npm. It cannot target DMCA notices accurately. These are not model safety problems. They are operational security failures that no amount of constitutional AI can fix.

When an EU company sends prompts to an American AI provider, it is trusting that provider's entire operational stack: vendor management, access controls, supply chain discipline, incident response. The Mythos breach shows that this trust is misplaced. Shared vendor API keys, predictable URLs, no network segmentation between contractor access and production models. If the most safety-conscious AI company in America operates this way, the rest are not going to be better.

This is why structural guarantees matter more than pledges. EU-only inference means every subprocessor is incorporated in the EU, operates EU data centers, and falls under EU jurisdiction. Zero Data Retention means prompts and completions are never stored, so there is nothing to leak in the first place. Published subprocessor lists mean the supply chain is auditable, not asserted. Multi-provider fallback routing means a single vendor's operational failure does not compromise your entire AI pipeline.

Anthropic built a model too dangerous to release and could not keep it behind a locked door. The door was a shared API key and a URL someone guessed on the first try. The next Mythos will not be less capable, and the next breach will not be harder to execute. The only question is whether your infrastructure depends on providers who cannot secure their own.

Sources