Anthropic says its Claude Mythos Preview research model can autonomously identify and, in many cases, exploit zero-day vulnerabilities in real software environments. The results span browser, operating-system, network-service, and cryptography-library code, making the work a significant illustration of how frontier AI could change defensive vulnerability research. They also sharpen the governance challenge: the same capabilities that can help defenders find flaws sooner can be adapted toward offensive cyber activity.
In Anthropic’s official Mythos Preview research post, the company describes a testing setup that combines Mythos Preview with Claude Code. The scaffold analyzes code, attempts to reproduce vulnerabilities, and generates proof-of-concept exploits. Anthropic frames the work as cybersecurity research, with coordinated disclosure and defense-in-depth central to its response.
What Anthropic tested and what it found
The reported demonstrations cover widely used open-source and deployed software, including Firefox, the Linux kernel, OpenBSD, and FreeBSD's Network File System service. Rather than treating vulnerability discovery as a purely theoretical benchmark, the research evaluates whether a model-driven system can move through practical stages of security work: understanding a codebase, finding a flaw, reproducing it, and producing an exploit proof of concept.
