Anthropic announces Claude Mythos, an AI model that autonomously finds and chains zero-day vulnerabilities—but locks it down under government oversight

Anthropic confirmed April 21, 2026 that Claude Mythos can identify previously unknown software vulnerabilities and build multi-stage attack chains in under 120 seconds, then discarded the standard release model: the model is restricted to a handful of partners (Microsoft, Google, CrowdStrike) under 'Project Glasswing,' a program monitored by CISA, NCSC (UK), and ENISA with immutable audit logs and a kill-switch clause.

Unlike older vulnerability-detection tools, Mythos uses dynamic testing in simulated environments (rather than just reading code) to spot memory leaks invisible to traditional scanners, then automatically maps multi-hop attack paths across different software layers and generates polymorphic malware—code that changes its signature on every execution, defeating signature-based antivirus. Benchmark: it cuts the time to find zero-days from 4–8 hours to under 12 minutes, and raises the functional exploit rate from 23% to 87%.

CISOs and security teams must now assume that if attackers gain access to even a 10% capability version of Mythos, traditional firewalls and antivirus become ineffective; the industry is racing to deploy AI-powered defensive models (CrowdStrike's Falcon AI Shield, Palo Alto's Adversarial AI Detection module, Microsoft's Defender updates) that can predict and block AI-generated attacks in real-time, shifting security from perimeter defense to zero-trust identity verification and process-level memory monitoring.