How a Discord Group Got Into Anthropic’s Mythos ‘Too Dangerous to Release’ AI Model And What It Means for Your Cybersecurity

A Quick Note Before You Read

Everything in this article is drawn from verified reporting by Bloomberg News, Fortune, TechCrunch, Cybernews, and Euronews, as well as official statements from Anthropic. Nothing here is speculation. Where something is still unconfirmed, it is stated as such.

What Just Happened

On April 7, 2026, Anthropic announced something it had never done before. It publicly acknowledged that one of its AI models was too dangerous to release to the general public.

The model is called Claude Mythos Preview. Anthropic restricted it to roughly 40 vetted organizations among them are Amazon Web Services, Apple, Google, Microsoft, JPMorgan Chase, Cisco, CrowdStrike and NVIDIA, under a controlled initiative called Project Glasswing. The goal was to use Mythos to find and patch critical vulnerabilities in the world’s most important software before hostile actors could develop comparable AI capabilities and exploit those same vulnerabilities first.

Then, on that exact same day, the very day the restricted announcement went public, a small group of unauthorized users gained access to Mythos. They had not been approved. They were not among the vetted partners. And they reportedly got in partly through a third-party contractor and partly by guessing the model’s URL based on Anthropic’s past practices.

This is not a rumor. Bloomberg News broke the story on April 21, 2026, confirmed by an Anthropic spokesperson who told TechCrunch: “We’re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments.”

First, You Need to Understand What Mythos Actually Is

Most AI models help you write emails or summarize documents. Mythos is built differently. In the weeks before the public announcement, Anthropic used Claude Mythos Preview internally to identify thousands of zero-day vulnerabilities, meaning software flaws that were previously unknown even to the developers who wrote the code across every major operating system and every major web browser currently in use.

Among the findings Anthropic disclosed publicly: a 27-year-old undetected bug in OpenBSD, a 16-year-old flaw in FFmpeg, and a memory corruption vulnerability in a memory-safe virtual machine. In one documented case, Mythos Preview fully autonomously identified and exploited a 17-year-old remote code execution vulnerability in FreeBSD (CVE-2026-4747) – a flaw that could give an attacker complete control over a server, starting from an unauthenticated position anywhere on the internet. No human was involved in finding or exploiting that vulnerability after the initial prompt.

That last sentence is worth sitting with. No human involvement. The model found it, built the exploit, and demonstrated control of the server entirely on its own.

Anthropic has been direct about how this happened: the company did not train Mythos to have offensive hacking capabilities. Those capabilities emerged as a side effect of improving the model’s general coding, reasoning, and autonomy, which means the same qualities that make it good at patching vulnerabilities also make it good at finding and exploiting them.

This dual-use reality which is powerful for defense but dangerous in the wrong hands, is exactly why Anthropic chose not to release it publicly. And it is exactly what makes the unauthorized access story significant.

How the Unauthorized Access Happened

Based on Bloomberg’s reporting and statements from Anthropic, here is what is currently known.

The unauthorized users were part of a private Discord channel specifically dedicated to gathering intelligence on unreleased AI models. One of the group’s members was employed by a third-party contractor that works for Anthropic. That contractor access provided an entry point. The group also used internet sleuthing tools and made an educated guess about the location of the Mythos Preview environment based on knowledge about the URL formatting conventions Anthropic has used for previous models – information that had previously leaked during a breach at AI startup Mercor.

Anthropic confirmed there was no direct breach of its own core systems. The unauthorized activity, as far as the company could determine, remained within the third-party vendor’s environment.

The group has reportedly been using Mythos regularly since gaining access. Bloomberg’s source, who provided screenshots and a live demonstration of the model as corroboration, said the group’s motivation was curiosity about new AI models, not launching cyberattacks.

The ShinyHunters cybercriminal group briefly attracted speculation as being responsible, with screenshots of an alleged “Mythos dashboard” circulating on social media. Security researcher Dominic Alvieri publicly debunked that attribution, describing the images as AI-generated fabrications.

There was also a second, separate incident around the same time: Anthropic accidentally exposed nearly 2,000 source code files and over half a million lines of Claude Code for approximately three hours due to an internal error. That issue has since been addressed.

Why the Method of Access Matters More Than the Breach Itself

Here is where this story becomes genuinely instructive for anyone responsible for security at a company, an institution, or even just their own network.

The unauthorized users did not defeat Anthropic’s encryption. They did not deploy nation-state malware. They guessed a URL and leveraged a contractor’s access. That is it. That is not a sophisticated attack. That is a vendor management and operational security failure. And those are, in many ways, harder to defend against than the technical threats most security frameworks are built to address.

David Lindner, CISO at Contrast Security with 25 years of industry experience, put it plainly to Fortune: once you expand access to a restricted system beyond a small core team, even to a group of trusted partners, a leak becomes increasingly probable. The more organizations that touch a system, the larger the surface area of potential exposure. Anthropic granted access to 40 organizations, each of which has its own staff, contractors, subcontractors, and access management processes.

Gabrielle Hempel, Security Operations Strategist at Elastic, made a related point to Cybernews: while the industry focuses on defending against sophisticated nation-state actors, third-party access paths have increasingly become the weakest link.

This is not a new observation in cybersecurity. But seeing it play out in the context of a model specifically restricted because of its attack capabilities drives the point home harder than most case studies.

What This Signals About Where AI Cybersecurity Is Heading

The Mythos access incident did not happen in isolation. It is one data point in a rapidly developing pattern.

In August 2025, Anthropic disclosed that a single attacker had exploited Claude’s code execution environment to run a three-month data extortion campaign targeting at least 17 organizations, including healthcare providers, government agencies, emergency services, and a defense contractor automating reconnaissance, credential harvesting, and network penetration at a scale that would have previously required an experienced team.

In November 2025, Anthropic announced it had helped disrupt what it described as the first known cyber espionage campaign conducted primarily by autonomous AI agents, which it attributed with high confidence to a state-sponsored group.

Now Mythos represents the next level: a model that, if put to offensive use, could potentially operate as an autonomous, full-cycle hacking system, finding vulnerabilities, building exploits, and executing attacks without human involvement at any step.

Anthropic has reportedly been warning senior US government officials about this trajectory privately. The US Treasury Secretary convened a meeting with leaders from major American banks in April to discuss the implications. British banking regulators have held parallel discussions with domestic lenders. Goldman Sachs, Citigroup, Bank of America, and Morgan Stanley are reportedly among the financial institutions testing Mythos within Project Glasswing.

Bruce Schneier, one of the most respected voices in security research, noted on his blog that much of the coverage has leaned toward repeating Anthropic’s framing without critical scrutiny, and that Project Glasswing is, in part, a PR effort. That is a fair observation. The initiative is genuinely useful, but Anthropic also benefits from being seen as the company responsible enough to restrict its most dangerous model rather than release it. Both things can be true.

What is harder to dispute is the underlying reality Schneier acknowledges: AI has reached a point where it can automate vulnerability discovery at a scale that makes the current patching paradigm structurally inadequate. The time between discovery and exploitation is compressing. Defenders are going to be playing catch-up more often.

What Businesses and Individuals Should Actually Do Right Now

None of this means the sky is falling today. The unauthorized users of Mythos have not been using it to attack systems. But the fact that a restricted, highly capable offensive AI model was accessed through a contractor and a URL guess within hours of its announcement is a signal worth acting on.

For businesses and IT teams:

• Audit your third-party access. Every vendor, contractor, and integration partner that touches your environment is a potential entry point. Review their access levels, credentials, and offboarding processes. Most unauthorized access incidents in recent years have come through third parties, not direct attacks.
• Tighten credential management. The Mythos incident involved contractor credentials. Implement the principle of least privilege where contractors and vendors should only have access to exactly what they need, for exactly as long as they need it, with multi-factor authentication required.
• Start thinking about AI-augmented attack surfaces. Your existing vulnerability scanning and patching cycles were designed around human-speed threat discovery. AI-augmented attackers can discover and exploit vulnerabilities faster than those cycles can respond. If your organization hasn’t reviewed its threat model in the last 12 months, this is a reasonable trigger to do so.
• Keep an eye on Project Glasswing developments. The vulnerabilities Mythos is finding across operating systems and browsers will be disclosed as they are patched. Staying current on those disclosures will matter.

For individual users:

The direct risk to individuals from Mythos specifically is low right now. But the broader trend it represents AI models that can find and exploit software vulnerabilities in operating systems, browsers, and apps you use daily is real and accelerating. The fundamentals of personal security matter more, not less, in this environment:

• Keep your operating system and browser updated. Many of the zero-days Mythos found are being patched through normal update processes.
• Use strong, unique passwords with a password manager. Credential-based access remains one of the most common attack vectors.
• Review which apps and services have third-party access to your accounts. The weakest link in Mythos’ case was a contractor, the same logic applies to the apps you’ve granted access to your email, calendar, or financial accounts.

If you want a deeper look at protecting your personal data in this environment, our guide on identity theft protection services covers the monitoring and recovery options that make the most difference. And for understanding how your mobile devices are being targeted in parallel, the mobile banking malware breakdown is worth reading alongside this.

A Comparison: Claude Mythos vs Other Significant AI Security Incidents

The pattern across these incidents is consistent: the entry points are operational and human, not primarily technical. Nation-state sophistication gets the headlines, but contractor credentials and employee missteps are what keep showing up in the actual incident reports.

The Bottom Line

Anthropic built a model capable of autonomously finding and exploiting vulnerabilities in the world’s most critical software. They chose not to release it publicly because of that capability. A Discord group accessed it anyway, on its first day of existence, through a contractor and a URL guess.

That is not a story about the catastrophic misuse of AI. The group in question has not used Mythos to attack anyone. But it is a clear illustration of how fast the gap between “restricted” and “accessed” can close, and how traditional assumptions about access control break down at the edges of a large partner ecosystem.

The more important story is what Mythos represents: a new category of AI capability where the model itself is a security tool and a security risk simultaneously, and where the speed of vulnerability discovery is outpacing the speed of patching. Project Glasswing is a genuine attempt to address that, but as Schneier noted, it is essentially a race, and the outcome of that race is not guaranteed.

For now, the most practical response is not alarm. It is updating your mental model of what AI-augmented threats look like, and making sure the fundamentals of your security posture such as access control, credential management, patch cadence are actually in order.

CyberPrivacyLab Team

CyberPrivacyLab Team is a cybersecurity-focused platform dedicated to helping individuals and businesses stay safe online.

Our expertise includes cybersecurity, ethical hacking, network defense, and privacy protection. We provide practical, research-backed insights designed to help users understand threats, secure their systems, and protect their digital identity.

Our content is informed by hands-on experience with industry-standard tools such as Kali Linux, Wireshark, Nmap, Security Onion and others, ensuring that our guides are both practical and relevant.

We are committed to delivering clear, accurate, and actionable cybersecurity knowledge to support safer digital experiences.