What it is
Claude Mythos Preview is Anthropic’s restricted frontier model for advanced cybersecurity work. It is distributed through Project Glasswing, a defensive security initiative involving major software and infrastructure organizations.
What is verified
The public record is split between broad claims and concrete entries. The concrete entries in this ledger are:
- CVE-2026-4747, the FreeBSD NFS/RPCSEC_GSS remote kernel RCE that Anthropic says Mythos Preview fully autonomously identified and exploited.
- Mozilla’s Firefox 150 release cluster, where Mozilla says Mythos identified 271 vulnerabilities and advisories explicitly credit researchers using Claude from Anthropic on specific CVEs.
- Anthropic’s August 26 coordinated vulnerability disclosure ledger, where 72 qualifying rows explicitly name Mythos Preview. They contain 61 unique CVEs and 59 unique GHSAs across 47 projects. The other qualifying cards are split by their Opus, Sonnet, unreleased, or model-unspecified labels.
- CVE-2026-8286 in curl, CVE-2026-47729 in Squid, and CVE-2026-45067 in Symfony, all with upstream records that name Mythos or connect the credited report to Project Glasswing.
What is not counted
Anthropic says Mythos found many other vulnerabilities in operating systems, browsers, FFmpeg, OpenBSD, Linux, and open-source projects. The dashboard also contains many disclosed or candidate items that are not publicly revealed at technical detail level. Bugflation does not count those as individual findings until they are publicly auditable.
Apple’s CVE-2026-28984 is also excluded from this profile. Apple credits Anthropic’s CVD program, but the cited Anthropic ledger contains no matching row and no public source names Mythos for that CVE.
Sources
- Anthropic Red Team: Mythos Preview capabilities
- Anthropic: Project Glasswing
- Anthropic: Coordinated vulnerability disclosure dashboard
- Anthropic CVD ledger JSON
- Mozilla: The zero-days are numbered
- VulnCheck: Tracking Anthropic and Glasswing CVEs
- curl: CVE-2026-8286
- Squid advisory: CVE-2026-47729
- Symfony advisory: CVE-2026-45067