{"id":25,"date":"2026-04-25T20:41:38","date_gmt":"2026-04-25T20:41:38","guid":{"rendered":"https:\/\/inhochoi.com\/index.php\/2026\/04\/25\/mythos-slipped-the-cage-notes-on-glasswings-first-real-test\/"},"modified":"2026-04-25T20:41:38","modified_gmt":"2026-04-25T20:41:38","slug":"mythos-slipped-the-cage-notes-on-glasswings-first-real-test","status":"publish","type":"post","link":"https:\/\/inhochoi.com\/index.php\/2026\/04\/25\/mythos-slipped-the-cage-notes-on-glasswings-first-real-test\/","title":{"rendered":"Mythos Slipped the Cage: Notes on Glasswing’s First Real Test"},"content":{"rendered":"

A little over two weeks ago, Anthropic announced Claude Mythos Preview and put it behind a deliberately small door called Project Glasswing \u2014 a phased rollout to “critical industry partners and open source developers” with the explicit goal of giving defenders a head start on a model that, by Anthropic’s own description, can find and exploit zero-days in shipping software. The bet was that if you give a sharp tool to the people patching things first, the asymmetry tilts toward defense long enough to matter.<\/p>\n

Last week the door turned out to be propped open. A small group of users on a private forum stumbled into Mythos through a third-party vendor environment \u2014 by, as Fortune phrased it, “guessing where it was located” \u2014 on the same day the limited-access program was announced. Anthropic has confirmed it’s investigating. As I write this, no one is claiming a catastrophic outcome. What we do have is the first real-world stress test of the Glasswing premise, and it’s worth being honest about what that test showed.<\/p>\n

What Anthropic actually built<\/h2>\n

Mythos Preview (codename Capybara) is a general-purpose frontier model that posts numbers most of us hadn’t expected to see this year \u2014 SWE-bench at 93.9%, USAMO at 97.6%, and a generational jump on cyber tasks specifically. The vibe in the public materials is unusually direct for Anthropic: red.anthropic.com calls it “strikingly capable at computer security tasks,” notes that during testing it discovered “thousands of high-severity vulnerabilities” across “every major operating system and web browser,” and frames Glasswing as a deliberate attempt to bias the rollout toward defenders.<\/p>\n

That framing matters because it’s not the standard “we hope it goes well” disclosure. Anthropic is explicitly saying this model raises the offensive ceiling enough that the order of access changes the threat model. That’s a real claim, and it’s one the next two sections actually back up.<\/p>\n

The numbers from AISI<\/h2>\n

The UK AI Security Institute’s evaluation, published April 13, is the cleanest third-party look so far. Two findings stuck with me:<\/p>\n

On expert-level capture-the-flag challenges \u2014 tasks that no model could complete at all before April 2025 \u2014 Mythos Preview succeeds 73% of the time. That’s not “AI is getting better at security CTFs.” That’s a category change.<\/p>\n

On AISI’s “The Last Ones” range \u2014 a 32-step simulated corporate-network attack they estimate would take a human professional roughly 20 hours \u2014 Mythos became the first model to solve it end-to-end, doing so in 3 of 10 attempts, with an average of 22\/32 steps completed. Claude Opus 4.6, the previous best, averaged 16. AISI’s chart shows performance still scaling up at the 100M-token budget they tested; they expect more compute to keep extracting more capability. Translation for defenders: the bottleneck right now is inference budget, not capability.<\/p>\n

The honest caveat AISI prints in plain English is that their ranges lack active defenders, EDR, and meaningful detection penalties. Mythos can chain a kill chain on a soft target. Whether it does so against a hardened, monitored estate is the next evaluation, not this one.<\/p>\n

How the leak happened (and didn’t)<\/h2>\n

The leak details we have are thin but instructive. Per the SiliconANGLE and CBS reports, the access path was a third-party vendor environment, not an Anthropic-side credential break. Per Fortune, the discovery vector was effectively guessing \u2014 pattern-matching where a limited-access endpoint might be hosted, then trying it. That’s the oldest move in the book: you don’t break the lock, you find the door no one remembered putting on the master key.<\/p>\n

This is the bit I keep returning to. Glasswing’s threat model assumes the perimeter you have to defend includes every partner you handed access to. The model is hard. Vendor-environment hygiene is hard in a different, much more boring way. The boring way is the one that broke first.<\/p>\n

What this means for defenders this week<\/h2>\n

A few things I’m doing or recommending around our estate, none of them novel, all of them more urgent than they were on April 7:<\/p>\n

The Cyber Essentials basics that NCSC and AISI both pointed at \u2014 patch cadence, access control, configuration baselining, real logging \u2014 are now the difference between “vulnerable to a skilled human attacker over a weekend” and “vulnerable to an autonomous agent over a coffee break.” If your patch SLA is 30 days for highs, that window is now quite a bit more expensive.<\/p>\n

If you’re a partner in any frontier-model preview, treat the access credentials as a Tier-0 secret on par with domain admin. The Glasswing leak is going to make every vendor questionnaire about model access materially more painful for the next twelve months, and rightly so.<\/p>\n

Detection assumptions need a refresh. Most of our content is tuned to human pacing and human mistakes. An agent that runs 22 steps of a kill chain in a single autonomous session won’t make the small, slow tells we instrument for. The next round of detection engineering is going to be about behavior-rate signals, not signatures.<\/p>\n

What I’m watching<\/h2>\n

Three things over the next couple of weeks. First, whether Anthropic publishes a real post-mortem on the vendor-side leak \u2014 not a “we are investigating” line, but the kind of write-up that lets the rest of us learn from a partner’s misconfiguration. Second, whether the UK government’s reported discussions about limited Mythos access produce any public structure for state-level defender programs; that’s the natural next ring outside Glasswing. Third, whether AISI’s hardened-range follow-up actually shows the capability gap I expect \u2014 because if Mythos still solves a defended estate at non-trivial rates, the calculus described in the foreign-policy commentary stops being theoretical and starts dictating procurement decisions.<\/p>\n

For now, my read is unchanged from a month ago: the model is real, the defender-first framing is the right framing, and the Glasswing leak is a caution about implementation rather than a refutation of the strategy. The asymmetry window is still there. It’s just smaller than Anthropic wanted it to be.<\/p>\n

Sources<\/h2>\n