Anthropic has made a surprising move in the AI arms race: it is indefinitely shelving its most powerful cybersecurity model, Mythos Preview. Even though internal tests showed the model could find and exploit vulnerabilities with terrifying efficiency, the company says it won't release it to the public or commercial markets until it develops stronger safety alignment. At a time when AI companies are racing to release ever-larger models and cutting API prices, this decision stands out as remarkably cautious.
In joint offensive-defensive tests over the past month, Anthropic and about 50 partners — including Microsoft, Oracle, Cloudflare, and Mozilla — used Mythos Preview to scan critical global infrastructure and uncover over 10,000 zero-day vulnerabilities rated High or Critical. The UK AI Safety Institute (UK AISI) called it the first model to end-to-end breach all of its simulated cyberattack training grounds. While vulnerability discovery efficiency jumped by more than tenfold — Mozilla, for example, used Mythos Preview to find and fix 271 bugs in Firefox 150, ten times more than with Claude Opus 4.6 — the security ecosystem now faces an unprecedented "patch overload" standoff.
Faced with the reality that finding bugs takes seconds while fixing them takes weeks, some open-source maintainers have asked Anthropic to slow down disclosure. To ease the defensive burden while the model remains locked away, Anthropic is pursuing an asymmetric defense strategy. Qualified security teams can apply for shared code maps, scanning sub-agent orchestration kits, and threat modeling tools. Enterprise customers can deploy a restricted Claude Security assistant, based on Claude Opus 4.7, which has already helped companies fix 2,100 vulnerabilities in three weeks. Anthropic also announced a deeper partnership with the OpenSSF's Alpha-Omega project to provide financial and manpower support for open-source maintainers handling vulnerability triage and patching.