Claude Mythos Preview and Project Glasswing: AI Models Can Now Out-Hack Most Humans

A 27-Year-Old OpenBSD Bug (PATCHED)

OpenBSD — one of the most security-hardened OSes in the world, used in firewalls and critical infrastructure — had a bug in its TCP SACK implementation dating back to 1998.

The vulnerability exploits two interacting bugs in how OpenBSD tracks SACK (Selective Acknowledgement) holes. The code maintains a singly linked list of “holes” — byte ranges sent but not yet acknowledged. A missing bounds check combined with signed integer overflow in 32-bit TCP sequence number comparison allows a remote attacker to trigger a NULL pointer dereference, crashing any OpenBSD machine that responds over TCP.

Found after ~1000 scaffold runs. The specific run that found it cost under $50.

A 16-Year-Old FFmpeg Vulnerability (PATCHED in FFmpeg 8.1)

FFmpeg’s H.264 decoder had a bug introduced in 2003, made exploitable in a 2010 refactor. The issue: the slice lookup table uses memset(-1) as a sentinel, making every entry read as 65535. If a crafted frame contains exactly 65536 slices, slice number 65535 collides with the sentinel, causing an out-of-bounds heap write.

Automated fuzzing tools hit this line 5 million times without catching it. The bug survived because you need to construct a specific pathological input — exactly the kind of creative reasoning LLMs excel at.

FreeBSD Remote Root (PATCHED, CVE-2026-4747)

This one is remarkable. A 17-year-old vulnerability in FreeBSD’s NFS server that allows unauthenticated remote root access. The RPCSEC_GSS authentication protocol copies attacker data into a 128-byte stack buffer with only 96 usable bytes, but the length check allows up to 400 bytes.

What makes it exploitable: no stack canary (the buffer is int32_t[32], not a char array, so the compiler skips instrumentation), no KASLR, and Mythos figured out how to get the required authentication handle via an unauthenticated NFSv4 EXCHANGE_ID call.

The ROP chain — over 1000 bytes — had to be split across 6 sequential RPC requests because each request only allows 200 bytes of overflow. Each request sets up a piece, and the final one calls kern_writev to append the attacker’s SSH key to /root/.ssh/authorized_keys.

Fully autonomous. Zero human intervention after the initial prompt.

Linux Kernel Privilege Escalation

Mythos found numerous Linux kernel vulnerabilities and chained them together for root access. In one example: read vulnerability to bypass KASLR, another to read struct contents, a third for use-after-free write, and a heap spray to land the payload — 4 vulns chained together.

They also demonstrated autonomous exploitation of known-but-patched N-day vulnerabilities:

• One-bit page table write (ipset/netfilter CVE): Manipulated the page allocator to physically-adjacent a kmalloc slab page with a PTE page, then flipped the writable bit on a /usr/bin/passwd mapping to inject a root shell stub. Cost: under $1000, half a day.
• One-byte read to root under HARDENED_USERCOPY: Chained a unix socket use-after-free with cross-cache reclaim, kernel stack reading, KASLR bypass, and a DRR scheduler UAF to call commit_creds() with a crafted credential struct copied from init_cred. Cost: under $2000, under a day.

Browser Exploits

Found and exploited vulnerabilities in every major web browser. One exploit chained four vulnerabilities together, including a JIT heap spray that escaped both the renderer sandbox and the OS sandbox. Another was turned into a cross-origin bypass for reading data from other domains.

On the Firefox JS engine specifically (tested with Opus 4.6 in an earlier collaboration): Opus 4.6 could only turn vulnerabilities into working exploits 2 out of hundreds of times. Mythos Preview? 181 times out of the same test, plus 29 more that achieved register control.

Cryptography Libraries

Found weaknesses in TLS, AES-GCM, and SSH implementations across major cryptography libraries. Includes a critical certificate authentication bypass disclosed on the same day as the announcement.

Memory-Safe VMM Bug

Found a guest-to-host memory corruption vulnerability in a production memory-safe virtual machine monitor (likely written in Rust or Java). The unsafe block needed for hardware interaction was the attack surface. Not yet patched.

Web Application Logic Bugs

Multiple complete authentication bypasses, login bypasses without password or 2FA, and remote data deletion DoS attacks. All unpatched.

The Code Report: Follow the Money and the Methodology

Anthropic’s own track record is shaky. They’ve been running Mythos internally since February 24th, and since then they managed to leak their own Claude Code source code, leak documents revealing Mythos’s existence, and had significant API stability issues. If Mythos is this capable, the fact that Anthropic itself keeps fumbling is… not a great look.

The cost numbers hide a brute-force process. The OpenBSD vulnerability — the headline 27-year-old bug — came from roughly 1,000 parallel agent runs across the codebase, costing nearly $20,000 in compute. Run the same mass-parallel process with Claude Opus 4.6 or GPT-5.4 Pro and you'd probably find plenty of issues too. The per-run cost of under$50 sounds impressive until you realize the denominator.

The Firefox benchmark was run with training wheels off… for the attacker. That 84% exploit success rate against Firefox isn’t against actual Firefox. It was tested against SpiderMonkey shell with the process sandbox and other security mitigations disabled. Real-world Firefox has multiple layers of defense that the benchmark stripped away. The number is directionally useful but shouldn’t be quoted as “Mythos exploits Firefox 84% of the time.”

ThePrimeagen: This Is the Playbook

ThePrimeagen’s reaction was more blunt: this is the same playbook Anthropic has run before. Every model release follows the same script — demonstrate impressive capabilities, then lean into the “too dangerous to release” angle to generate hype, attract government attention, and secure partnerships. The exact same “it’s too dangerous” narrative was pushed with GPT-2. We’ve been here before.

His key observation: Anthropic is deliberately rage-baiting the industry. As one commenter put it, “They called it Mythos because no one’s ever going to see it.” The model is being gated behind a cartel of trillion-dollar companies and government agencies — not because the public can’t be trusted, but because exclusivity drives perceived value and regulatory capture.

On the benchmarks themselves, ThePrimeagen points out that Humanity’s Last Exam scores of 56.8% (no tools) and a D-grade with tools are being framed as revolutionary. “This is some serious PhD level intelligence going on here” — except a D isn’t exactly the flex Anthropic thinks it is.

The emotional manipulation is the real story. The constant barrage of “it can hack everything, it’s the end of the universe” messaging creates a pressure cooker that benefits Anthropic: scared governments fund AI safety research, scared enterprises buy API access through approved channels, and scared developers accept that they’ll never touch the good models directly. Fear is the product.

Tom’s Hardware: Where’s the Evidence?

Jon Martindale at Tom’s Hardware drilled into the math behind Anthropic’s headline claims and found a significant gap between the narrative and the data. The company says Mythos found “thousands” of high- and critical-severity zero-days — but of those, only 198 were manually reviewed by security experts. The remaining findings were classified by the model itself, with no independent human verification of severity or exploitability.

Many of the so-called zero-days are in older software that may already be mitigated by modern security controls, or may be theoretically possible to exploit but practically infeasible in real-world conditions. This is an important distinction — a vulnerability that exists in source code is not the same as one that can be weaponized against a production system.

The broader critique: Anthropic’s announcement is structured more like a product launch than a security disclosure. “Too dangerous to release” creates exclusivity and perceived value, the partner list of trillion-dollar companies signals importance, and the restricted access model means no independent third party can verify the claims. The cybersecurity capabilities are real — but the framing is indistinguishable from marketing.

Gary Marcus: Three Reasons It Was Overblown

AI researcher Gary Marcus laid out three concrete arguments on Substack that question the gap between Anthropic’s narrative and the underlying evidence:

The Firefox demo ran without a sandbox. Security researcher Philo Groves flagged that Mythos’s headline Firefox exploitation benchmark — the one showing 181 successful exploits versus Opus 4.6’s two — was run with browser sandboxing disabled. That’s not how real browsers work. In production, the sandbox is the primary defense layer; exploiting a browser without it is a fundamentally different (and easier) problem. Anthropic also built on top of existing Opus research rather than starting from scratch — making the “181x improvement” framing misleading.

Small open models can reproduce the same findings. Hugging Face CEO Clément Delangue had his team take the specific vulnerabilities Anthropic showcased in their announcement, isolate the relevant code, and test them against small, cheap open-weight models. The result: those models recovered much of the same analysis — eight out of eight showcase vulnerabilities. If a 3.6-billion parameter model costing $0.11 per run can detect the same exploits Mythos found, the marginal advantage of restricting access to a frontier model becomes less clear.

The capability trend line hasn’t accelerated. Ramez Naam normalized Anthropic’s internal Effective Compute Improvement (ECI) metric against EpochAI’s public benchmark and found that Mythos sits right on the existing trend line — slightly above GPT-5.4, but with no deviation that would suggest a qualitative leap. The apparent “trend break” in Anthropic’s chart is an artifact of their internal ECI catching up to the public one, not a sudden acceleration in capability.

Marcus’s verdict: “To a certain degree, I feel that we were played. The demo was definitely proof of concept that we need to get our regulatory and technical house in order, but not the immediate threat the media and public was led to believe.”

The Verdict

The model isn’t publicly available, and Anthropic controls all the benchmarks, all the disclosure, and all the narrative. That’s not a conspiracy — it’s responsible disclosure — but it does mean independent verification is impossible right now. Is Mythos genuinely better than Opus 4.6 at offense? Probably yes. Is the gap as dramatic as the cherry-picked benchmarks suggest? We literally cannot know until someone outside Anthropic gets to test it.

The healthy stance: take the findings seriously, take the marketing with a grain of salt, and remember that “dangerous AI we can’t show you” is a position that demands extra skepticism, not less.