Anthropic's Secret Mythos Model Leaked — A Step Change in AI Cyber Capabilities

The most safety-conscious AI lab just accidentally revealed its most dangerous model

On March 26, Fortune broke the story: Anthropic's content management system had been misconfigured, leaving a publicly accessible data cache that contained detailed specifications of a previously unknown model. The model's name is Claude Mythos, internal codename Capybara, and Anthropic's own draft blog post described it as "a step change" in AI capability.

Here's the kicker. The leaked draft contained this line from Anthropic itself:

"This model is far ahead of any other AI model in cyber capabilities and could spark a wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders."

That's not an external critic sounding the alarm. That's Anthropic's own assessment of what they built.

The backstory — How Anthropic's safety-first mission became a paradox

Anthropic was founded in 2021 by Dario and Daniela Amodei after leaving OpenAI. The core thesis was straightforward: to do frontier AI safety research, you need to build frontier AI models. That philosophy has driven every product decision since.

The strategy worked. Claude models have consistently ranked near the top in coding, reasoning, and safety benchmarks. By late 2025, Anthropic's estimated annualized revenue approached $19 billion, closing the gap with OpenAI's $25 billion. The company had earned its reputation as the responsible counterweight in the AI race.

Metric	Claude Opus 4.6 (Current)	Claude Mythos (Leaked)
Generation	Current flagship	Next-gen ("step change")
Coding	Top tier	"Dramatically higher"
Academic reasoning	Top tier	"Dramatically higher"
Cybersecurity	High	"Far ahead of any other AI model"
Self-repair	Limited	Recursive self-fixing

The irony is impossible to ignore. The company that built its brand on AI safety just had its most powerful model exposed because of a CMS misconfiguration. The "most responsible AI company" narrative now sits alongside "builder of the most dangerous AI model."

What Mythos can actually do

Recursive self-fixing

The standout capability in the leaked documents is "recursive self-fixing." Think of it like this: instead of an AI that points out a bug when you ask, Mythos can autonomously scan an entire codebase, identify vulnerabilities, and patch them in a continuous loop.

Existing AI coding tools could already flag issues. GitHub Copilot and Claude itself could say "this code has a SQL injection vulnerability." What makes Mythos different is the autonomous, iterative, codebase-wide scale of the operation.

The market reaction

Cybersecurity stocks dropped sharply after the leak. The fear is straightforward: if AI can find and exploit vulnerabilities faster than defenders can patch them, the fundamental economics of cybersecurity shift. Bitcoin also slid, reflecting broader anxiety about software-based security.

The bigger picture — An AI cyber arms race is taking shape

Mythos didn't emerge in isolation. The broader AI landscape has been building toward this moment.

OpenAI's GPT-5.4 shipped with a 1-million-token context window and autonomous multi-step workflow execution, scoring 75% on OSWorld-V. NVIDIA's Nemotron 3 Super hit 60.47% on SWE-Bench Verified, the top score for any open-weight model. Alibaba's Qwen 3.5 Small released multimodal open-source models from 0.8B to 9B parameters.

The trend is clear: every major AI lab is pushing code understanding and execution capabilities simultaneously. Mythos just happens to be the first where the lab itself called the result "unprecedented" in cybersecurity terms.

Model	Cyber capability	Availability
Claude Mythos	Autonomous vuln detection + patching	Unreleased (leaked)
GPT-5.4	Autonomous workflows, 1M context	Public
Nemotron 3 Super	SWE-Bench 60.47%	Open weight
Claude Opus 4.6	Top-tier coding	Public

What this means for you

For developers and security professionals, this changes a few things.

First, AI-powered security tooling demand is about to explode. If attackers use AI, defenders must too. The "AI vs AI" security era is here.

Second, code review standards are shifting. If AI can autonomously find vulnerabilities at scale, human-only code review becomes insufficient. AI security verification in CI/CD pipelines moves from nice-to-have to essential.

Third, AI governance just got a real-world stress test. Anthropic builds frontier models for safety research, but one CMS misconfiguration exposed the whole thing. This isn't a technical problem. It's a governance problem.

Finally, expect regulation to accelerate. The EU AI Act is already in effect, but there's no framework for models with this level of cyber capability. Mythos exposed that gap.

---

References

• Exclusive: Anthropic 'Mythos' AI model representing 'step change' in power revealed in data leak — Fortune
• Anthropic accidentally leaked details of a new AI model that poses unprecedented cybersecurity risks — Fortune
• Cybersecurity stocks plunge as Anthropic's Claude Mythos leak sparks AI fear — Yahoo Finance
• What is Anthropic's Mythos? — Euronews