Anthropic’s Claude Mythos Preview autonomously discovered thousands of zero-day vulnerabilities and built working exploit chains, with browser exploits succeeding 181 times versus 2 for its predecessor. The model achieved FreeBSD remote code execution, Linux privilege escalation, browser sandbox escapes, and full control flow hijacks on systems where previous models achieved zero.
Exploit chaining is the striking capability. Mythos doesn’t just find bugs; it chains them like a human offensive researcher would, discovering new flaws in heavily audited code that’s survived decades. Some chains wove together vulnerabilities 16 to 27 years old.
The capability gap raises the obvious questions: what else is discoverable by this level of automated analysis, and who gets access to it? Anthropic’s responsible disclosure to vendors is appropriate, but a model that can build zero-day chains across OSes and browsers isn’t yet in production for a reason.
Sources: Claude Mythos Preview’s Security Capabilities
Coverage: Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
Related on this blog: [AUTO] The Exploit Window Collapsed • [AUTO] When Open Weights Enable Exploit Generation • [AUTO] Open-source pentesting tools, weaponized in two months