Nicholas Carlini and coauthors argue in Anthropic’s post that Mythos Preview raises cybersecurity risks

Nicholas Carlini and coauthors argue in Anthropic’s post that Mythos Preview raises cybersecurity risks

On April 7, 2026, Nicholas Carlini and the other authors listed on Anthropic’s page argue that Claude Mythos Preview can find and exploit vulnerabilities at a level that changes the near-term security challenge. They report finding vulnerabilities across major operating systems and web browsers, and describe exploits that could give attackers root access or compromise a victim’s machine. The authors say these capabilities emerged from general improvements in code, reasoning and autonomy, rather than explicit training for cybersecurity tasks. Their central warning is about the transition: attackers could gain an advantage before defenders adapt, even though the authors expect language models eventually to strengthen defense. They say Mythos Preview will remain unavailable for general use and describe Project Glasswing as a limited effort to help critical industry partners and open-source developers secure important systems. Their proposed response includes using available models for security work, shortening patch cycles and preparing for more vulnerability reports and incidents. The authors conclude that the security community should act now and prepare for a broader rethinking of computer security. How many reported vulnerabilities will be validated and patched, and how quickly defenders can close the gap remain unknown.

Publication: c7fa4e70-377f-6f32-be08-c4058c46c9b4

attribution — pass: This is a single Anthropic research post with a byline led by Nicholas Carlini, so crediting Carlini, his listed coauthors and Anthropic is correct. The page notes a later author-list update, but Carlini is listed first in the captured text. The reading keeps the claims attributed to the authors rather than presenting them as established fact.

Nicholas Carlini, Newton Cheng, Keane Lucas, Michael Moore, Milad Nasr

summary — uncertain: The reading conveys the authors' argument and their transition-period warning faithfully. However, central terms go unexplained and no definitions are supplied: 'exploit', 'root access' and 'patch cycles' in the summary, and 'N-day exploit walkthroughs' in the limitations. A non-specialist may not grasp what root access means or what an N-day is, although the source itself defines N-day. Smallest repair: one plain-language gloss for each term, or tooltip entries for them.

turning N-day (that is, known but not yet widely patched) vulnerabilities into exploits

date — pass: The stated date of April 7, 2026 matches originalPublished (an instant, UTC day) and the source's own phrasing, 'Earlier today we announced'. The page was edited after publication (an April 9 author-list note; modifiedAt October 23). The cited passages are plainly part of the original article body. No hindsight framing is used, and the open question stays framed as unknown. Archive disclosure is not required because the evidence is a publisher page.

Earlier today we announced Claude Mythos Preview, a new general-purpose language model.

support — uncertain: Most claims are grounded in the source. However, the summary says Mythos Preview 'will remain unavailable for general use', which turns a stated plan into a settled outcome. It also omits the authors' stated eventual goal of safely deploying Mythos-class models at scale. Smallest repair: 'they say they do not plan to make Mythos Preview generally available'. The page was edited after publication, but the cited passages appear to be original text.

we do not plan to make Claude Mythos Preview generally available, our eventual goal is to enable our users to safely deploy Mythos-class models at scale

media — pass: No media was selected and no verified media candidates were supplied, so no media item was invented or misidentified.