A configuration error in Anthropic’s internal content management system exposed nearly 3,000 unpublished files, including a draft blog post and internal materials describing a new, unreleased AI model called Claude Mythos, which Anthropic has now confirmed it is testing as its most advanced system to date. The company describes Mythos (internally codenamed Capybara) as a “step change” model that sits above its current flagship Claude Opus, with especially large gains in reasoning, coding, and cybersecurity capabilities, and warns that its cyber skills are far ahead of existing models. According to the leaked draft and subsequent reporting, Claude Mythos/Capybara dramatically outperforms Claude Opus 4.6 on software engineering, academic reasoning, and security benchmarks, and Anthropic has completed training and moved into a limited early-access testing phase. The leak has raised particular concern because the draft describes the system as “currently far ahead of any other AI model in cyber capabilities” and warns that it could enable the discovery and exploitation of software vulnerabilities at a scale that could outpace defenders, potentially facilitating large‑scale cyberattacks if misused. In response, Anthropic says it is restricting early access to organizations focused on cyber defense and is proceeding cautiously with release, citing both safety risks and high serving costs, with no public API, pricing, or launch timeline announced yet. This incident is significant on two fronts: first, it highlights an ongoing data security lapse at a leading AI lab, where a simple CMS misconfiguration briefly made strategic, technical, and product-planning documents publicly searchable. Second, it underscores an emerging policy and security challenge around so‑called offensive cyber-capable foundation models: if systems like Mythos can autonomously find and weaponize vulnerabilities better than current tools, they may shift the balance between attackers and defenders, forcing governments, enterprises, and AI developers to reconsider access controls, red‑teaming practices, and timelines for deploying their most capable models.

AI-generated background, compiled from web sources — not editorial content.

More coverage

Explore the topic

Loading related coverage…

Comments

Loading comments…