Unauthorized group has gained access to Anthropic’s exclusive cyber tool Mythos, report claims

Unauthorized Access to Anthropic's Dual-Use Cyber AI

A group of unauthorized users has reportedly gained access to Mythos, the powerful cybersecurity AI tool recently announced by Anthropic. The incident, first reported by Bloomberg, is significant because Anthropic designed the tool with a limited release specifically to prevent its misuse, acknowledging that its capabilities could be weaponized for malicious hacking. The access was allegedly obtained on the same day the tool was announced, calling into question the security protocols surrounding the AI industry's most sensitive products.

How the Breach Unfolded

The breach appears to be a classic case of supply chain vulnerability. An Anthropic spokesperson confirmed the company is “investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments.” The group, part of a private Discord channel focused on unreleased AI models, reportedly used an employee at a third-party contractor to facilitate access. They located the tool by making an “educated guess about the model’s online location based on knowledge about the format Anthropic has used for other models.”

• Who: An unidentified group from a private online forum.
• What: Gained access to Anthropic's cybersecurity AI, Mythos.
• How: Through a third-party vendor environment, leveraging insider access and pattern analysis of Anthropic's URLs.
• Evidence: The group provided screenshots and a live demonstration to Bloomberg.

This incident undermines the very premise of controlled-access programs like Project Glasswing, the initiative under which Mythos was released to select partners like Apple. While the group reportedly told Bloomberg their interest is in experimentation rather than “wreaking havoc,” the event demonstrates the inherent difficulty of containing potent, dual-use AI systems. It puts a spotlight on the security posture not just of AI labs themselves, but of their entire ecosystem of partners and contractors.

The Mythos incident is a stark reminder that advanced AI containment strategies are only as strong as their weakest human or third-party link, shifting the focus of AI safety from theoretical alignment to practical, real-world operational security.