Anthropic’s Claude Mythos Got Accessed Without Permission. Here’s What We Know
Anthropic is dealing with a security headache of its own — and the irony isn’t lost on anyone. The company behind one of the most talked-about AI cybersecurity tools is now investigating unauthorized access to that very tool.
According to a report from Bloomberg, a group gained entry to Claude Mythos through a third-party contractor portal, combined with some internet sleuthing to figure out where the model was hosted. So far, the group appears to be curious rather than malicious — but that doesn’t make the situation any less awkward.
What Is Claude Mythos and Why Does It Matter
Claude Mythos launched earlier this month as part of something Anthropic calls “Project Glasswing.” It’s a specialized version of Claude built specifically to find security vulnerabilities in software.
The results have been genuinely impressive. Mozilla used the model to find and patch 271 vulnerabilities in Firefox. That’s not a small number. Banks and government agencies have also been lining up for access, eager to use AI to shore up their own systems.
Because of those capabilities, Anthropic kept the initial release very tight. Only a handful of trusted companies got access — Amazon, Microsoft, Apple, Cisco, and Mozilla among them. The idea was to be careful with a tool this powerful before releasing it more broadly.
How the Unauthorized Access Happened
Here’s where things get interesting. According to Bloomberg, the group found their way in through a developer portal — and essentially made an educated guess about where the model was sitting. No sophisticated hacking. No elaborate breach. Just persistence and web-based detective work.
The group reportedly coordinates on a private Discord server. And the situation may go further than just Mythos. The same people could also have access to other unreleased Anthropic models, according to the Bloomberg report.
Anthropic confirmed it’s looking into the incident. “We’re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments,” the company said in a statement.
The Bigger Concern Behind the Story
The unauthorized access itself might not cause immediate harm. But it highlights a real tension in the AI security space.
Claude Mythos has drawn both excitement and unease from the security research community. On one hand, a model that can find 271 Firefox bugs in a short window of time is genuinely useful. On the other hand, that same capability could be pointed in the wrong direction. Alex Zenla, CTO of cloud security firm Edera, recently told Wired that AI-generated cyberattacks could become a “real threat” — and tools like Mythos are exactly what people have in mind when they say that.
The model finding its way into the hands of unauthorized users — even well-intentioned ones — is precisely the kind of scenario Anthropic was trying to avoid with its restricted rollout.
Anthropic’s Rocky Relationship With Washington
This comes at a complicated moment for Anthropic politically. The US Department of Defense recently designated the company as a “supply chain risk,” which is a significant label to carry. Anthropic has reportedly been in talks with the Trump administration to get that designation removed.
A security incident involving one of its most sensitive tools probably doesn’t help those conversations.
Still, the company is young, growing fast, and clearly building things that attract serious attention — from enterprise clients, government agencies, and now, apparently, curious outsiders looking to poke around.
How Anthropic handles the fallout from this incident will say a lot about how seriously it takes the “responsible AI” mission it’s built its brand around.
