AI Check · · Claude Mythos is Anthropic's unreleased frontier AI model. On March 26, 2026, Fortune exclusively reported that Anthropic's web CMS had left close to 3,000 unpublished assets publicly accessible with no login required — including a draft blog post revealing Claude Mythos, the unreleased model the company called its most capable ever built. This check reconstructs the leak, what Mythos turned out to be, and the lesson hiding inside the irony.
The leak in one paragraph. Anthropic's content management system stored all website content — published and unpublished — in a central store reachable without authentication, and assets were public by default unless someone explicitly changed the setting. Anyone with technical knowledge could query it and pull material never published to Anthropic's site. Two security researchers, Roy Paz of LayerX Security and Alexandre Pauwels of the University of Cambridge, independently located and reviewed the cache. After Fortune contacted Anthropic on Thursday evening, the company removed public access and blamed "human error" in the CMS configuration. REPORTED · FORTUNE, MARCH 26, 2026
The cache held close to 3,000 assets linked to Anthropic's blog that had never been published on the company's news or research sites, according to Pauwels, whom Fortune asked to assess the material. Beyond the Mythos draft, it included details of a planned invite-only CEO summit in Europe — part of Anthropic's enterprise sales push — plus internal images, documents, and other product announcements. The root cause, per the reporting, was not a hack: the CMS simply answered public queries with unpublished material, because nobody had flipped the default. As one write-up put it, the researchers just asked the CMS politely what it had, and the CMS answered. Anthropic said the incident was unrelated to Claude, Cowork, or any Anthropic AI tools.
Claude Mythos is an unreleased Anthropic frontier model that the leaked draft described as a "step change" in AI performance and "the most capable we've built to date." The company said it believed the model posed unprecedented cybersecurity risks and was far ahead of any other AI model in cyber capabilities. It sits in a new model tier called Capybara — larger and more capable than the Opus models, which were Anthropic's most powerful public tier. Anthropic has not released Mythos to the public.
These are Anthropic's own claims about the model, as reported from the leaked draft and the company's subsequent statements — not independent measurements. ANTHROPIC'S CLAIMS
Twelve days after the leak story, on April 7, 2026, Anthropic launched Project Glasswing: a restricted deployment of Claude Mythos Preview for defensive vulnerability discovery, backed by $100 million in model usage credits and 12 founding partners including AWS, Apple, Google, Microsoft, NVIDIA, Cisco, CrowdStrike, JPMorgan Chase, Broadcom, Palo Alto Networks, and the Linux Foundation. The results it produced explain the "unprecedented" language: MEASURED · ANTHROPIC DISCLOSURES
In OpenBSD — widely regarded as one of the most security-hardened operating systems in existence — Mythos autonomously identified a vulnerability that had survived 27 years of code audits. Anthropic described it as letting remote attackers repeatedly crash machines running a vulnerable service: a remote denial-of-service, not code execution. Researcher Nicholas Carlini, who worked with the model, said he had found more bugs in testing than in the rest of his career.
The most serious finding: a 17-year-old remote code execution flaw in FreeBSD's NFS server (CVE-2026-4747) that gives an unauthenticated attacker full root access from anywhere on the internet. Mythos found it and built a complete working exploit — ROP chain, kernel memory writes, persistent access — fully autonomously, with no human involvement after the initial instruction. An independent firm later showed the same flaw could be exploited with an older model, but only with human guidance.
In FFmpeg's H.264 decoder, Mythos found a 16-year-old buffer overflow in a line of code that automated testing tools had hit more than five million times without triggering detection — a code path random input could not reach but logical reasoning could. On May 22, 2026, Anthropic reported the model had uncovered more than 10,000 high- or critical-severity vulnerabilities, with roughly 50 partner organizations scanning under Glasswing. The bottleneck, Anthropic said, was no longer finding vulnerabilities — it was the human workload of verifying and patching them.
Here is the part that should sit with you. The company building what it called the most cybersecurity-capable AI model in existence — a model it judged too dangerous to release — had its existence revealed not by a sophisticated adversary, not by prompt injection, not by a supply-chain compromise, but by a content management system whose defaults nobody checked. Frontier-model risks increasingly arrive as boring operational mistakes in places AI safety rhetoric never reaches: a CMS toggle, a default-visible draft folder, an asset endpoint nobody audited. The draft warning about unprecedented cybersecurity risk was itself sitting in an unsecured database. The threat model that mattered was not the model at all.
The lesson is not about Anthropic; it is about every organization running a CMS. Drafts, staging sites, media libraries, and asset endpoints are routinely public by default, and "unpublished" in your admin panel does not mean "inaccessible." Audit your own defaults: query your asset endpoints without logging in, enumerate staging and preview URLs, restrict publish permissions, and review anything a previous team member may have left visible. The vulnerability that exposed Claude Mythos was a checkbox — and it is sitting in thousands of other dashboards right now.
Anthropic's web content management system stored all website content — including drafts — in a central system accessible without authentication, and assets were public by default unless someone explicitly changed the setting. Security researchers Roy Paz of LayerX and Alexandre Pauwels of the University of Cambridge independently located and reviewed the exposed cache of close to 3,000 unpublished assets. Anthropic locked it down after Fortune made contact and blamed human error in the CMS configuration.
Claude Mythos is an unreleased Anthropic frontier model described in the leaked draft as a step change in capability — the most capable the company had built to date. Anthropic said it posed unprecedented cybersecurity risks and was far ahead of any other AI model in cyber capabilities. It sits in a new tier called Capybara, above the Opus models. Anthropic has not released it publicly.
Under Project Glasswing, Mythos Preview autonomously found thousands of zero-day vulnerabilities, including a 27-year-old remote-crash bug in OpenBSD, a 17-year-old FreeBSD remote code execution flaw (CVE-2026-4747) giving unauthenticated remote root access, and a 16-year-old FFmpeg bug that more than five million automated fuzzing runs had missed.
No. Reporting describes it as a configuration error, not an intrusion: the CMS answered public queries with unpublished material because assets were public by default. Anthropic attributed it to human error in the CMS configuration and said it was unrelated to Claude, Cowork, or any Anthropic AI tools.
Audit your CMS default visibility settings — assume drafts are public until proven otherwise. Search your own site's asset endpoints without logging in, enumerate unpublished or staging URLs, restrict who can publish, and review anything a previous team member may have left set to public by default.
Sources: Fortune (exclusive, March 26, 2026); Infosecurity Magazine on Project Glasswing (April 7, 2026); Futurum Group; ThreatAft; Cloudfest; sovereignmagazine.com; newspointapp.com; dpexnetwork.org. Short quoted phrases are attributed to Anthropic's draft and statements as reported; all other figures are paraphrased from the cited reporting. "Claude mythos" is not yet volume-researched — no search-volume claims are made on this page.