Claude Mythos is Actually Scary

Summary
Greg from the Low Level YouTube channel analyzes Anthropic’s unveiling of Claude Mythos Preview and Project Glasswing, evaluating their implications for cybersecurity and vulnerability research. He discusses Anthropic's decision to withhold general public access to Mythos, exploring the shifting asymmetry between offensive exploitation and software defense.

What is shown

• [00:16] Anthropic's "Project Glasswing: Securing critical software for the AI era" webpage.
• [00:27] Excerpt from Anthropic's announcement detailing Claude Mythos Preview discovering zero-days in major OSs and browsers, including a 27-year-old bug in OpenBSD.
• [01:11] Anthropic paper titled "Assessing Claude Mythos Preview’s cybersecurity capabilities" (dated April 7, 2026), including a benchmark chart for Firefox JavaScript shell exploitation comparing Sonnet 4.6, Opus 4.6, and Mythos Preview.
• [02:54] Report text highlighting autonomous full-chain exploits: a multi-vulnerability browser sandbox escape via JIT heap spray, Linux privilege escalation via race conditions, and a FreeBSD NFS remote code execution exploit using a 20-gadget ROP chain across multiple packets.
• [03:25] Anthropic case study on Mythos identifying a memory corruption vulnerability within a memory-safe virtual machine monitor (VMM).
• [04:08] Project Glasswing partner roster, including AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, Microsoft, The Linux Foundation, NVIDIA, and Palo Alto Networks.
• [04:52] Anthropic statement outlining why Claude Mythos Preview will not be made generally available.
• [08:46] Brief sponsor promotion for the creator's educational platform, Low Level Academy.
• [09:53] X (Twitter) discussions with Theo (@t3dotgg) and Justin Elze (@HackingLZ) evaluating the impact of automated vulnerability discovery on critical infrastructure and high-churn codebases.

Claims & numbers

• Vulnerability discovery: The presenter notes Anthropic's testing found Mythos identified zero-day vulnerabilities in every major operating system and web browser, including a 27-year-old bug in OpenBSD [00:30].
• Firefox JavaScript shell exploitation benchmark:
  • Claude Sonnet 4.6 achieved register control in 4.4% of trials and 0% full exploit completion [01:50].
  • Claude Opus 4.6 achieved register control in 14.4% of trials and completed one working exploit [02:04].
  • Claude Mythos Preview generated a successful working exploit in 72.4% of trials and achieved register control on another 11.6% [02:16].
• Automated exploitation complexity: Anthropic reported Mythos autonomously chained four vulnerabilities with a JIT heap spray escaping renderer and OS sandboxes, bypassed KASLR on Linux, and built a FreeBSD NFS RCE with a 20-gadget ROP chain [02:54].
• Memory safety: Mythos identified an out-of-bounds write memory corruption flaw in an unpatched production VMM written in a memory-safe language (Rust) involving unsafe memory operations [03:30].
• FFmpeg legacy bug: Mythos identified a 16-year-old vulnerability in FFmpeg's H.264 parsing logic [07:40].
• Availability: Anthropic explicitly stated it does not plan to release Claude Mythos Preview to the general public, restricting initial access to Project Glasswing partners [04:52].

Notable quotes

• [00:00] "Anthropic just dropped a new AI model, and honestly, it's kind of terrifying."
• [02:16] "Mythos has a 72.4 percent success rate on writing a successful exploit when given a vulnerability."
• [12:18] "What happens in between? What is the in-between period where people get access to the models, the code is not secure yet, the bugs are not found yet..."

Assessment
This is an independent commentary and technical review discussing Anthropic's published research paper on Claude Mythos Preview and the launch of Project Glasswing. The presenter reviews publicly disclosed benchmark figures and research findings from Anthropic's release materials rather than demonstrating live execution of the unreleased model.

Described by gemini-3.8-flash on 2026-09-29 from the video's audio and frames.