Claude Mythos Preview: Anthropic’s Unreleased AI Cracked Linux and OpenBSD Bugs People Missed for Many years – Bitcoin Information

[ad_1] Key Takeaways:

Anthropic’s Claude Mythos Preview scored 83.1% on Cybergym, discovering hundreds of zero-days throughout each main OS and browser. Venture Glasswing launched April 7, 2026, with 11 founding companions and as much as $100 million in Mythos utilization credit for defenders. A 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug survived hundreds of thousands of automated assessments till Mythos discovered them in hours. Claude Mythos AI Scored 83% on Cybergym and Discovered Vital Flaws Throughout Each Main Browser and OS The mannequin, which Anthropic describes as the most important single-model functionality achieve in frontier AI historical past, accomplished coaching and was introduced publicly on April 7, 2026, after inside particulars surfaced in late March via a misconfigured content material administration system that uncovered roughly 3,000 inside recordsdata.

Anthropic will not be releasing the Claude Mythos Preview to the general public or via its common API. The corporate restricted entry to a vetted group of companions after the mannequin demonstrated it may uncover and exploit unknown software program flaws beforehand at a pace and scale that outpaces each human consultants and prior AI programs.

On cybersecurity benchmarks, the hole between Mythos and Claude Opus 4.6 is tough to disregard. Mythos scored 83.1% on Cybergym versus 66.6% for Opus 4.6, and 93.9% versus 80.8% on SWE-bench Verified. On SWE-bench Professional, it posted 77.8% towards 53.4% — a 24-point unfold. It hit 56.8% on Humanity’s Final Examination with out instruments, in comparison with 40.0% for its predecessor.

The mannequin doesn't want cybersecurity-specific coaching to search out these bugs. Its positive factors come from broader advances in reasoning, multi-step planning, and autonomous agentic habits. Given a goal codebase in an remoted container, it reads supply code, types hypotheses about memory-safety flaws, compiles and runs the software program, makes use of debuggers like Handle Sanitizer, ranks recordsdata by vulnerability chance, and produces validated bug studies with working proof-of-concept exploits.

A few of these exploits required virtually no human route. Tomshardware.com studies {that a} 27-year-old OpenBSD TCP SACK vulnerability, a refined integer overflow that lets an attacker remotely crash any responding host by crafting malicious packets, was discovered autonomously after roughly 1,000 runs at a complete price beneath $20,000. A 16-year-old FFmpeg H.264 bug survived greater than 5 million automated assessments and a number of audits earlier than Mythos caught it.

The browser outcomes drew specific consideration. On Firefox 147 JavaScript engine testing, Mythos produced 181 full shell exploits and 29 register-control circumstances. Claude Opus 4.6 produced two shell exploits throughout the identical take a look at set. The mannequin additionally constructed working Linux kernel privilege-escalation chains, person to root on servers, after filtering 100 current CVEs all the way down to 40 exploitable candidates and efficiently exploiting greater than half.

Human validators reviewed 198 of the mannequin’s vulnerability studies and agreed with its severity scores 89% of the time, with 98% settlement inside one severity degree.

Venture Glasswing Fewer than 1% of the recognized bugs have been totally patched to date. Anthropic is coordinating accountable disclosure, publishing cryptographic SHA-3 commitments for unpatched points, and following a 90-plus-45-day timeline earlier than releasing full particulars. FreeBSD NFS server distant code execution bug CVE-2026-4747, 17 years outdated, granting full unauthenticated root entry, is among the many named examples already in disclosure.

Venture Glasswing, introduced alongside the mannequin, is Anthropic’s try and direct these capabilities towards protection earlier than comparable instruments turn into extensively obtainable. Founding companions embody Amazon Net Companies, Apple, Broadcom, Cisco, Crowdstrike, Google, JPMorganChase, the Linux Basis, Microsoft, Nvidia, and Palo Alto Networks. Entry is being prolonged to greater than 40 further crucial software program organizations.

Anthropic dedicated $4 million in open-source safety donations: $2.5 million to Alpha-Omega via the OpenSSF through the Linux Basis, and $1.5 million to the Apache Software program Basis.

The corporate acknowledged that AI instruments like Mythos decrease the barrier for locating and exploiting vulnerabilities, and flagged near-term threat from state actors, China, Iran, North Korea, and Russia, and felony teams if comparable capabilities unfold with out controls. It described a interval of transitional turmoil earlier than defenders totally combine the expertise.

Anthropic mentioned upcoming Claude Opus releases will embody safeguards to detect and block harmful cybersecurity outputs, and plans to introduce a Cyber Verification Program for vetted safety professionals. A public report on companion findings and patched vulnerabilities is predicted inside 90 days.