10,000 Bugs. 271 Firefox Fixes. One AI Model.

What Claude Mythos can actually do — and why “too capable” turned into a problem nobody had planned for.

Credit : AI Generated Image (2026)

Start with the number, because the number is what stopped people cold.

In the first month of a closed research program, a single Anthropic model surfaced more than 10,000 high- or critical-severity vulnerabilities across the software that runs banks, browsers, and operating systems.

These weren’t theoretical bugs.

They were reachable vulnerabilities, many accompanied by working proof-of-concept exploits.

That model is Claude Mythos.

The strange part of the story is that nobody set out to build a hacking machine.

Anthropic has been clear that Mythos was trained as a general-purpose frontier model, strongest at coding and long-running agentic work. Its cybersecurity capability emerged almost as a side effect. A model capable of understanding and rewriting complex software naturally becomes capable of finding what is broken inside it.

The capability wasn’t the goal.

It was simply an unexpected consequence — one that turned out to be sharper than anyone anticipated.

What the model is, in plain terms

The publicly documented specifications sound fairly ordinary until you stop and think about what they imply.

Mythos Preview ships with:

• A one-million-token context window
• 128K maximum output
• A December 2025 knowledge cutoff
• Availability through Claude API, Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry under a gated research program

It also operates using adaptive thinking rather than fixed reasoning.None of those specifications are remarkable by themselves. What matters is the behavior built on top of them.

The workflow is surprisingly simple.

Drop the model into an isolated container containing a codebase. Give it Claude Code. Ask it something as straightforward as:

“Please find a security vulnerability in this program.”

The model reads the code, forms a hypothesis, executes the software, validates or rejects the idea, inserts debugging logic, tests again, and repeats the process until it either finds nothing or produces a verified vulnerability complete with reproduction steps.

Now imagine running hundreds of these agents simultaneously, each inspecting a different part of the codebase.

The tedious work that once protected software no longer provides any protection.

Machines never get bored. ⚙️

Related Reading: Mythos Isn’t Just Another Model — It’s a Warning Shot

[embed]Mythos Isn’t Just Another Model — It’s a Warning Shot Anthropic may have quietly changed the rules of AI access ⚡medium.com

The receipts

Self-reported benchmarks should always be viewed carefully. Treat these results as Anthropic’s own account rather than absolute truth. Even so, the reported outcomes are difficult to ignore.

According to Anthropic:

• Mythos topped ExploitBench and ExploitGym.
• It reached the ceiling on Cybench.
• Microsoft reported strong performance against its internal CTI-REALM benchmark.

Across roughly seven thousand software entry points, a single pass reportedly uncovered hundreds of crashes and achieved complete control-flow hijacking on ten fully patched targets.

The individual discoveries are even more memorable.

• A 27-year-old bug in OpenBSD.
• A 16-year-old vulnerability buried inside widely used video software that automated tooling had executed millions of times without detecting.
• A 17-year-old remote code execution flaw in FreeBSD.
• Mozilla patching 271 Firefox vulnerabilities within approximately two weeks of limited access.
• A reported case in which the model detected a fraudulent $1.5 million wire transfer while it was still in progress after attackers compromised customer communications.

Independent reviewers introduce useful skepticism.

The UK’s AI Security Institute concluded that Mythos was not dramatically better than competing models on isolated security tasks. Where it separated itself was in completing long, multi-step infiltration challenges. Some of those tasks had never previously been solved by any other model.

That is the real signal.

Single-shot brilliance is becoming common. Maintaining competence across long chains of reasoning, while continuously correcting mistakes, remains much rarer and much more significant.

Why “very capable” became a liability

This is where the story changes. Software security used to be limited by discovery. The slow part was finding vulnerabilities. According to Anthropic’s own assessment, the bottleneck has now shifted. The difficult part is no longer discovering vulnerabilities. It is verifying them, responsibly disclosing them, and patching them quickly enough.

When enterprises own their software, patches arrive rapidly. When vulnerable code belongs to an open-source project maintained by a handful of volunteers, the queue grows. Some vendors reportedly released far larger patch batches than usual simply to keep pace.

The uncomfortable reality is obvious.

The same capability that allows defenders to identify every reachable vulnerability also allows attackers to do exactly the same thing. Anthropic ultimately judged the offensive capability significant enough to restrict access instead of releasing the model publicly.

Jeff Williams, founder of OWASP, framed the economic consequence simply.

Once frontier AI performs bug hunting at scale, paying humans for routine vulnerability discovery becomes increasingly difficult to justify.

I’ll offer an opinion, because this is where opinion belongs. The “happy accident” explanation is honest. It is also more unsettling than a deliberately engineered cyberweapon. Weapons are designed intentionally. They usually come with oversight, planning, and safety reviews.

An unexpected capability emerging from a better coding model arrives without any of those safeguards.Researchers discover what they have built only after extensive testing.That is the real story behind Mythos.Nobody deliberately aimed at this capability.

What it changes for the rest of us

For security teams, the practical takeaway is uncomfortable. Any vulnerability assessment completed before this class of AI existed now reflects yesterday’s standard. A clean penetration test from last year only proves what human testers found last year. It says very little about what hundreds of coordinated AI agents could uncover this afternoon.

There is also a hopeful interpretation.

If defenders gain access first and use these systems to strengthen operating systems, browsers, and other critical infrastructure — the internet quietly becomes safer. Fewer existing vulnerabilities remain available for anyone to exploit.

That appears to be the logic behind Anthropic’s decision to place Mythos inside a defensive consortium rather than exposing it through a public API.

The unanswered question remains the most important one. What happens when this capability is no longer restricted to a small group?

What happens when a model this capable of discovering vulnerabilities becomes available to anyone — defender and attacker alike?

Mythos has already shown us what is possible.

It has not yet shown us what comes next. 🚨