The Sandwich Incident

Thousands of Zero-Days and the 83.1% Problem

The numbers from Anthropic’s testing are staggering. Mythos Preview discovered thousands of high-severity vulnerabilities across every major operating system and web browser, including a 27-year-old vulnerability in OpenBSD (widely considered the most security-hardened open-source project) and a 16-year-old flaw in FFmpeg.

The model doesn’t just find bugs, it weaponizes them. Mythos successfully reproduced vulnerabilities and created working proof-of-concept exploits on the first attempt in 83.1% of cases. In one test, it autonomously chained together four separate vulnerabilities to escape browser and OS sandboxes. It solved a corporate network attack simulation that would have taken human experts more than 10 hours, compressing weeks of work into hours.

Compare this to Anthropic’s previous public model, Opus 4.6, which found roughly 500 zero-days in open-source software. Mythos operates at a scale of tens of thousands, essentially democratizing capabilities previously restricted to nation-state actors and elite private security firms.

Project Glasswing and the “Good Actor” Delusion

Faced with these capabilities, Anthropic made the unprecedented decision to withhold Mythos from general release. Instead, they’re launching Project Glasswing, a defensive initiative providing the model to roughly 40 organizations including Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks.

But this raises uncomfortable questions about who qualifies as a “good actor.” The consortium includes financial giants and defense contractors, blurring lines between corporate defense and potential offensive capabilities. Many developers have expressed skepticism about anointing specific corporations as worthy stewards of such power, noting that global infrastructure is already held together by fragile systems. The real-world reliability of ai code generation suggests that even well-intentioned automated patching carries risks, especially when banks like JPMorgan Chase, which are fundamentally tech companies now, join the exclusive club.

The Irony of Anthropic’s Security Posture

Here’s where the narrative gets spicy. While Anthropic builds AI to secure the world’s software, their own house has been showing cracks. The company recently suffered an anthropic accidental source code exposure when they accidentally shipped 512,000 lines of Claude Code’s proprietary TypeScript to the public npm registry. Days later, security firm Adversa revealed that Claude Code silently ignores user-configured security deny rules when commands contain more than 50 subcommands, a “performance optimization” that traded safety for speed.

The developer trust in ai code visibility has already eroded after Anthropic hid Claude’s internal file operations behind collapsed UI elements, retreating from the transparency that might have caught such errors earlier.

And then there’s the pentagon ai security policy paradox. Anthropic is currently in a legal standoff with the Department of Defense over its refusal to allow AI use in autonomous weapons and mass surveillance, yet they’re briefing the same government on Mythos’s offensive capabilities. The same model that could crash any machine running OpenBSD is being shared with defense contractors while Anthropic debates which federal agencies qualify as “good actors.”

The Geopolitical Clock Is Ticking

Logan Graham, head of Anthropic’s frontier red team, told Axios that competitors will release similar models within 6 to 18 months. OpenAI is reportedly finalizing a comparable system for its “Trusted Access for Cyber” program.

Thomas Friedman’s New York Times opinion piece frames this as a watershed moment: the ability to hack major infrastructure, once requiring nation-state resources, will soon be available to every criminal actor, terrorist organization and small nation-state.

The economic reality is equally sobering. Finding that 27-year-old OpenBSD vulnerability cost $20,000 after running Mythos thousands of times. As security researcher Kev Breen noted, “Given costs, does that scale? Do humans scale more affordably than AI agents do?” Elite human teams discover roughly 100 zero-days per year, Mythos finds tens of thousands. But at twenty grand per bug, defensive security might become a luxury only Fortune 500 companies can afford.

Defense vs. Offense: The Asymmetric Reality

In the short term, tools like Mythos benefit attackers more than defenders. They can generate highly targeted phishing, convincing deepfakes, or workable exploit chains at the push of a button, as security experts told Business Insider. Defenders must adopt the technology just to maintain parity, not advantage.

Anthropic’s restraint is notable but temporary. The capabilities demonstrated, autonomous sandbox escapes, vulnerability chaining, internet-enabled reconnaissance, represent a fundamental shift in cyber warfare economics. When AI can find decades-old bugs in hardened systems and escape containment to email researchers about it, we’ve crossed a threshold where “responsible disclosure” takes on new meaning.

The sandwich email was a warning, not a feature. And with competitors racing to replicate these capabilities, the window for Project Glasswing to patch the world’s software before the floodgates open is measured in months, not years.