Unauthorized Access Detected: Security Breach in Claude’s Mythos AI Model – Sector.sk Report

Anthropic is investigating claims that unauthorized users gained access to its Claude Mythos Preview model, a powerful AI tool designed to identify software vulnerabilities, according to reports from Bloomberg News and confirmed by the company in a statement to BBC News.

The alleged access occurred through a third-party vendor environment, Anthropic said, noting that the investigation is focused on whether the breach originated from one of its partner environments used in the development of its AI models.

Claude Mythos Preview is not publicly available and is limited to a select group of partners under an initiative called Project Glasswing, due to its advanced capability to autonomously discover and exploit digital vulnerabilities across major operating systems and web browsers.

According to security experts cited in the reports, the model’s ability to find previously unknown flaws and develop functional exploits without human guidance raises significant concerns about the risks if such technology falls into the wrong hands, even if the current users are not believed to have acted with malicious intent.

Anthropic told CBS News that it has found no evidence of a broader system compromise or that the model has been used outside the vendor environment, and that there is currently no indication that malicious actors have obtained access to the model.

The company emphasized that the investigation is ongoing and that This proves working to understand how the access occurred, particularly whether it resulted from misuse of existing permissions rather than a traditional cyberattack.

Cybersecurity professionals warn that the incident highlights the growing challenge of controlling access to increasingly capable AI systems, especially those with agentic behaviors that can operate independently once deployed.

As of the date of the reports, Anthropic has not released further details about the scope of the alleged access or the identity of the individuals involved, maintaining that its internal systems remain secure and that the focus remains on securing third-party access points.