Anthropic just announced that its unreleased model, Mythos, found “thousands of zero-day vulnerabilities” across operating systems and browsers, including bugs that had been hiding for 27 years. The model is so capable, they say, that it “surpassed all but the most skilled humans” at finding and exploiting security flaws.
The response was predictable. Headlines about AI’s terrifying new capabilities. Commentators warning about what happens when such power falls into the wrong hands. A coalition of major tech companies -- AWS, Apple, Google, Microsoft, NVIDIA -- rallying around Anthropic’s new Project Glasswing to deploy these capabilities defensively.
There’s just one problem: the only people who have tested this model are Anthropic and the Glasswing coalition partners who signed on to the initiative. No independent researcher has verified the claims.
And if you’ve been paying attention, you’ve seen this movie before. Twice.
Act I: GPT-2, the text generator that was “too dangerous” (2019)
In February 2019, OpenAI announced GPT-2 and refused to release it. The justification: its text-generation capabilities could “automate the mass-production of propaganda.” Researchers warned about “reasonable-sounding, context-appropriate prose” that could “drown out all other speech.”
The media ran with it. The “too dangerous to release” framing became the story itself.
What actually happened? Independent researchers replicated GPT-2 within months. OpenAI eventually released the full model in November 2019. And by then, The Verge was already noting that “there are reasons to be skeptical about claims that AI technology will usher in some sort of ‘infopocalypse.’”
OpenAI itself later confirmed: “no strong evidence of misuse.”
The predicted catastrophe never materialized. But the marketing worked. GPT-2 put OpenAI on the map as the AI company -- the one building things so powerful they required restraint.
Act II: Q*, the model that “alarmed staff” (2023)
In November 2023, Reuters reported that OpenAI was working on a model called Q* (later linked to Project Strawberry) that was “so powerful it alarmed staff.” The story broke alongside Sam Altman’s brief firing, and the implication was clear: this model was so dangerous it may have contributed to a boardroom crisis.
The coverage was enormous. Every news outlet in the world picked it up. “Some at OpenAI believe Q* (pronounced Q-Star) could be a breakthrough in the startup's search for what's known as artificial general intelligence (AGI).”
Again: nobody outside OpenAI had seen Q*. The claims were based on anonymous sources. No benchmarks, no demonstrations, no independent verification.
What eventually shipped -- the o1 and o3 reasoning models — turned out to be genuinely useful. Good at math, strong at coding. But not exactly the existential threat the coverage implied.
And the internal crisis was more complex than just one model release, as a recent investigation in The New Yorker showed.
Act III: Mythos, the vulnerability hunter (2026)
Which brings us to today. Anthropic’s Mythos announcement follows the exact same beats:
Extraordinary claims: Thousands of zero-days, 27-year-old bugs, capabilities that surpass elite humans
No public access: The model remains unreleased. Benchmarks are self-reported
Fear as the frame: “The window between vulnerability discovery and exploitation has collapsed”
Safety as the narrative: We built something incredible and dangerous, but trust us to handle it responsibly
The formula is elegant. “Too powerful to release” simultaneously achieves three things: it positions the company as safety-conscious, it generates massive free press, and it makes independent verification impossible by design.
What the coverage is missing
Here’s what makes the Mythos case particularly interesting: someone actually did the work of checking the claims.
An AI-native application security platform, AISLE (so yes, a competitor) ran Anthropic’s flagship findings through existing models. The results:
8 out of 8 models detected Mythos’s headline FreeBSD exploit — including models you can run on a laptop
Small open models (3.6 billion parameters) outperformed most frontier models at data-flow tracing with fewer false positives
A 5.1 billion-parameter open model recovered the core vulnerability chain that Anthropic presented as requiring Mythos-level reasoning
Fort’s conclusion: “The moat in AI cybersecurity is the system, not the model.” The real advantage isn’t having a secret, all-powerful model. It’s building the orchestration, the expert scaffolding, the relationships with software maintainers.
This doesn’t mean Mythos isn’t impressive. It might be. But the gap between “Mythos found these bugs” and “only Mythos could have found these bugs” is enormous. And most coverage has collapsed the two.
The pattern worth naming
I’m not suggesting these companies are lying about their models’ capabilities. GPT-2 was genuinely good. The o-series models are genuinely useful. Mythos may genuinely be a strong vulnerability researcher.
What I’m pointing out is a pattern in how these capabilities are communicated.
It’s the most effective marketing playbook in tech, and it costs nothing. You don’t need to buy ads when you can get coverage about how your product might be too powerful for society to handle.
The thing is, “too powerful to release” and “not ready to release” are very different claims. Security researchers doing their work, with all their expertise, is one thing. Layering it in marketing messages is a different one. But they generate the same headlines.
What I’d like to see
I’m not asking for cynicism. I’m asking for caution.
When a company says their model found a 27-year-old bug, ask: could existing models have found it too? (AISLE showed they could.)
When a company says their model “surpasses all but elite humans,” ask: what’s the benchmark, who ran it, can others replicate it?
When a coalition of tech giants signs onto a defensive initiative, ask: what exactly are the terms? Who gets access? What does it cost?
These aren’t hostile questions. They’re the same questions we’d ask about any other product launch in any other industry.
Is it purely a question of perception? Or actual coverage? Or both? Potentially relevant security concerns being raised by researchers too often pans out into an impression of the technology as too important, too complex, too potentially dangerous. It is precisely the dynamic these announcements are designed to exploit.
Mythos might turn out to be everything Anthropic says it is. But “might” is doing a lot of work in that sentence. And until someone outside the building gets to verify the claims, the appropriate response isn’t fear.
It’s curiosity, with a healthy dose of “show me.”