Unauthorized Access to Anthropic’s Mythos Preview Exposed Supply-Chain Weaknesses

Anthropic is investigating reports that unauthorized users accessed its unreleased Claude Mythos Preview model through a third-party vendor environment tied to its restricted Project Glasswing rollout, rather than through Anthropic’s production API. Multiple reports say a small private Discord-based group obtained access by combining a contractor’s credentials or environment access with an educated guess of the model’s online location, allegedly aided by information exposed in the recent Mercor breach linked to a LiteLLM supply-chain attack. Anthropic said it has no evidence so far of unauthorized use beyond the third party’s IT environment, while the incident has drawn attention to vendor, insider, and supply-chain risk around tightly controlled AI deployments.

The breach also intensified scrutiny of Anthropic’s claims that Mythos was too dangerous for broad release because of its offensive cybersecurity capabilities. Researchers and early evaluators cited by several outlets said Mythos appears fast and useful for vulnerability discovery, but not clearly beyond the reach of elite human researchers or materially more dangerous than existing public or open models. Critics also disputed Anthropic’s reported results, including claims about thousands of severe vulnerabilities and standout exploit discoveries, with some saying notable findings were attributable to other Claude models or depended on human guidance and weakened test conditions.