Anthropic's Claude Mythos Preview Ties to 10,000+ Vulnerabilities

The six months from April through September 2026 opened with Claude Mythos Preview, which Anthropic announced on April 7 and deliberately kept out of general circulation, offering it instead to organizations inside Project Glasswing — AWS, Apple, Google and Microsoft among them. That choice shaped what came next: within weeks, the program's interim report on May 22 counted more than 10,000 high-severity vulnerabilities across participants' systems, a volume that reframed the security debate.

The Japanese government moved quickly. On May 18, 14 ministries and agencies — among them the Cabinet Secretariat's National Security Secretariat, the National Cybersecurity Office, the Financial Services Agency and the Digital Agency — named Mythos Preview directly and published a set of countermeasures as Project YATA-Shield, covering alerts to critical infrastructure operators and secure-by-design practices. Four days later, the Financial Services Agency and the Bank of Japan jointly asked financial institutions to respond on a short-term basis with management involvement, on the stated basis that vulnerabilities can be discovered in large numbers within a short period.

The body also notes that the same half year brought the public release and three-day suspension of Fable 5, the arrival of GPT-6 Astra in September, and a shift in how large companies build AI agents — keeping their own controls while running on the clouds of AWS, Microsoft and Google. The pattern running through these threads appears to be that capability advances keep arriving faster than the institutions meant to oversee them.