Imagine you run security for a bank or a public agency. There is an AI model that can find and help fix long-buried flaws in your software. You just can’t use it. Access is limited to a few dozen organizations. That is the situation today with Anthropic’s Claude Mythos Preview. The model is kept closed because it is powerful, and that closure decides who gets to defend first.
What is Claude Mythos Preview, and why isn’t it public?
On April 7, 2026, Anthropic announced an initiative called Project Glasswing. At its center is Claude Mythos Preview, an unreleased frontier model. “Frontier model” refers to the most capable class of model a company has built. Anthropic states plainly that it does not plan to make this model generally available.
The reason is its strength in cybersecurity. The same capability cuts both ways. In a defender’s hands it finds a flaw before it spreads. In an attacker’s hands it shortens the path to exploiting that flaw. So Anthropic reserved the model for defensive work by a limited group that builds or maintains critical software.
How capable is the model in cybersecurity?
According to Anthropic, Mythos Preview has found thousands of high-severity vulnerabilities, including flaws in every major operating system and web browser. The examples it gives are concrete. A 27-year-old vulnerability in OpenBSD could let an attacker crash a remote machine. A 16-year-old flaw in FFmpeg had been hit five million times by automated testing without being caught. In the Linux kernel, chained vulnerabilities allowed escalation from ordinary user access to full control of the machine.
Anthropic reports that Mythos Preview scored 83.1 percent on the CyberGym security benchmark, compared with 66.6 percent for the earlier Claude Opus 4.6. Those are the company’s own numbers, which is why an independent test matters.
The UK’s government-run AI Security Institute (AISI) published its evaluation on April 13, 2026, six days after the announcement. AISI calls the model a step up over previous frontier models. On expert-level CTF tasks, competition-style challenges where you exploit a vulnerability to capture a hidden “flag”, it succeeded 73 percent of the time. No model could complete those tasks before April 2025.
The more striking result came from AISI’s 32-step simulated attack on a corporate network, a scenario the institute estimates would take a human expert about 20 hours. Mythos Preview became the first model to solve it end to end, doing so in 3 of 10 attempts and completing an average of 22 of the 32 steps. Claude Opus 4.6 averaged 16.
AISI is also clear about the limits. The model could not complete “Cooling Tower”, a range that simulates industrial control systems; the institute notes it got stuck on the IT sections. More importantly, the test ranges had no active defenders, no defensive tooling and no penalty for triggering alerts. AISI therefore cannot say how the model would fare against well-defended systems.
Who got access, and who is still waiting?
Glasswing’s launch partners are 12 organizations: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. Anthropic says it extended access to more than 40 additional organizations that build or maintain critical software infrastructure. It committed up to $100 million in usage credits and $4 million in direct donations.
For an organization not on that list, the picture is different. The model is not generally available; access is granted by invitation or application, on terms the company sets. An October 6, 2026 update on Anthropic’s page announces an expanded Cyber Verification Program with three access tiers and says existing Glasswing members will move to the Specialized Access tier. So the door is not fully shut, but the company decides who walks through which door.
Where does Europe’s cybersecurity agency stand?
On the government side, the announcement mentions only ongoing discussions with US officials. ENISA, the European Union’s cybersecurity agency, is not on the list. According to a June 1, 2026 report by heise online, an ENISA spokesperson said talks about access were underway but that the conditions were still being negotiated. The European Commission said it had held “several productive meetings” with Anthropic. The report said ENISA would be the first EU authority to get access; the Commission gave no timeline.
One point under negotiation was how far Anthropic’s access to EU systems would extend when European bodies use the model. That sounds like a technical footnote, but it is the core of the matter. Scanning your own infrastructure with a vendor’s model can mean sharing some knowledge about that infrastructure with the vendor.
I read this as a question of security boundaries. In April, the 12 launch partners were predominantly US-based companies, the first independent evaluation came from the UK, and in June the EU’s cybersecurity agency was still negotiating terms. That is less a delay than an ordering: the early advantage in defense sits with whoever has access. An organization without it has to assume the same flaws can be found by others. Which door are we opening? Shared access also means a shared data boundary, and I think Europe’s caution about not opening that door before the contract spells it out is the right call.
What does this mean in practice?
AISI’s recommendations may sound routine, but in this context they carry weight: apply security updates regularly, keep access controls and security configuration tight, and maintain comprehensive logging. The institute also points to the NCSC’s Cyber Essentials scheme in the UK and urges investment in cyber defense now, since future frontier models will be more capable.
The logic is simple. The kind of flaws Mythos Preview finds sit in old code that went unnoticed for years. Once patches for them are released, systems that delay patching become the easiest targets. Even without access to the model, your patching speed is in your hands. Organizations don’t control the access list, but they do control the pace at which they maintain their own systems.
