Mythos: Forget the Model. Follow the Workflow.

In early April 2026, Anthropic announced Claude Mythos Preview, a model initially restricted to vetted partners through a private partnership with selected security companies, called Project Glasswing.

Mythos was pitched as a frontier system built specifically for autonomous cyber operations, including writing offensive code, identifying exploits, and finding vulnerabilities.

Selected companies were able to test and experiment with Mythos across various security topics. Cloudflare, for example, used the model for security testing and vulnerability discovery. They noted that Mythos is effective at finding flaws and is able to surface vulnerabilities and security issues that previous models missed. However, Cloudflare also pointed out that the most important part of using a model, no matter how advanced it is, is the AI harness. Don't worry—we'll get back to that.

The announcement of Mythos came with hype, part of which came straight from Anthropic's own framing. The company pitched Mythos as especially strong at cybersecurity, and that framing created most of the excitement around it. The model is better than the previous generation, no question, but the claim might also be exaggerated. The buzz came from two things at once: The model had unusually strong reported performance on security tasks, and Anthropic didn't release it broadly.

Reports said Mythos could uncover serious vulnerabilities in major software and operating systems, which made it sound almost like a "superhuman" security tool. Scarcity amplified the rest. Describe a model as both powerful and too risky for open release, and you've guaranteed attention from security teams, investors, and everyone in between. This is even more of a factor for a tool that finds vulnerabilities, in a world where zero-days sell to underground markets and governments for serious money and get treated as strategic weapons.

Mythos, Fable, or Fable Mythos?

A quick disclosure before we go further: neither of the authors of this blog has had first-party Mythos access. What we say about Mythos here comes from public reporting and what partners have shared. However, Fable is different — it shipped publicly, and we've both had our hands on it since.

In June 2026, among a number of Anthropic announcements over the last few months, they introduced a new model called Fable, which is supposed to be a Mythos-level model but with guardrails.

When the model came out, multiple people, including us, started to experiment with Fable for cybersecurity and rapidly hit a wall. Fable is so restricted by its guardrails that even tiny security-related questions, and sometimes questions that are not even related to security, trigger a downgrade to Opus.

So, we started to experiment with adjacent tasks. The trick is to focus the “attention” of the model on parts of your project that are unrelated to direct security. For example, if you are doing vulnerability research and want to look for potential vulnerabilities, you may want to narrow down your tasks to make it able to run. However, the moment Fable touches anything related to security it might trigger the guardrails, so you'll have to play a bit and make sure to segment the data according to what you want.

These guardrails are also likely a result of the partnership between Anthropic and Amazon, Microsoft, and Google to draft a consensus industry framework for scoring the severity of AI jailbreaks (on things like capability gain, breadth of that gain, ease of weaponization, and discoverability), giving developers a way to triage bypass techniques as new models ship.

After a few days of testing Fable, we could definitely notice some improvements. The model is better at one-shotting tasks, meaning you don't need to craft highly detailed prompts or complex loops to complete a task. However, that doesn't mean it is game-changing.

The Harness Matters More Than the Model

Earlier in this blog we mentioned the AI harness, so what is it exactly?

First, let's make the distinction between an AI model, the brain, and an agentic workflow or AI agent.

The AI model, or LLM, is the brain of your system. This is where the generated knowledge comes from. However, without external tools or systems connected to that brain, your LLM will be very limited. It won't be able to enrich its reasoning with tools required for cybersecurity tasks, such as running scanners to fingerprint open ports or disassembling code to understand the internal behavior of a malware sample.

This is an important distinction, because using an LLM without external tools won't get you very far when we are talking about advanced tasks such as reverse engineering or vulnerability research.

An AI harness, or what we called context engineering last year, is all about defining your AI workflow through multiple elements: the prompts you write for your goal, the tools connected to your AI agent to enrich your investigation or research, your guardrails to avoid prompt poisoning or reduce hallucinations, and other workflow elements.

Most Mythos experiments in cybersecurity have not been run without a harness. Claude Code is a harness. Codex is a harness. OpenClaw and Hermes Agent are both harnesses. These are coding agents or simple agents connected to your computer that can create, execute, and run code, search online for information, write files to keep track of execution, and repeatedly test until they satisfy a condition. That makes a huge difference in terms of capabilities.

Mythos alone is less impressive than the workflow built around it, but connected to the right harness, it can chain exploits, understand complex codebases, reason across multiple steps, and find innovative ways to exploit previously uncovered flaws.

But seriously, you could already do these things. This was already possible before Mythos. What changed is how little engineering it now takes to do them.

That is the whole story.

If you only remember one concept from this blog, make it that one.

Yes, Mythos (and Fable) is better at one-shotting tasks, building websites, creating animations, writing presentations, and many other activities. It gets there with fewer iterations. But those same things were already possible with a good harness and maybe a few more iterations using previous models. Even using the Ultrathink feature to increase reasoning with Claude code makes it close to Fable level.

And don't just take our word for it. The receipts have been piling up in public for over a year, long before anyone whispered the word "Mythos."

Startups and teams had already built pentesting agents that find vulnerabilities. The capability was there. Mythos mostly makes it easier and more accessible, especially for people who don't want to learn AI architecture. Here's the receipt trail:

And here's the news that should kill the "one magic model" story for good. In April 2026, researchers published Synthesizing Multi-Agent Harnesses for Vulnerability Discovery. They took a mid-tier, open-weight model, wrapped it in a purpose-built multi-agent harness, and pulled 10 previously unknown zero-days out of Google Chrome, including two critical sandbox escapes that Google confirmed (CVE-2026-5280 and CVE-2026-6297). Ten Chrome zero-days from a mid-tier open model and good plumbing. No frontier lab required.

The harness did the heavy lifting, not the raw model. Sound familiar?

Even the benchmarks agree. Within ExploitGym, the first realistic benchmark for turning a bug into a working exploit, Mythos came out on top with working exploits for 157 of 898 real-world cases. Right behind it? GPT-5.5 at 120. Those are ceiling numbers from a controlled benchmark, not what you'd get against a hardened production target. And the gap between first and second? That closes with a bit more engineering. Tools like the open-source Raptor project already turn any off-the-shelf coding agent into an autonomous researcher, so none of this is gated behind a lab.

And we haven't even talked about open-weight models like GLM, which are just as impressive and more concerning, because they ship with zero guardrails and zero cybersecurity restrictions. Once the weights are out, that's it. Nobody's putting them back in the box.

So yes, Mythos is easier to use for people who don't want to learn AI architecture, and there's a reason for that. Building an accurate, reliable AI system is hard, and Mythos takes a lot of that pain out. It doesn't just hand you a capability that wasn't already within reach.

Where Are We Going?

So where does this leave us?

Mythos probably isn't the AI apocalypse people keep predicting. It'll keep equipping defenders and attackers alike, and the gap between the two was never going to come down to who has the fanciest model. It comes down to who adapts.

On top of that, AI is becoming a geopolitical tool. The US restrictions on Fable are the first clear signal of where this is heading, and they crack open a much bigger question about AI sovereignty.

Rewind to June 2026. Days after Anthropic shipped Fable 5 to the public and Mythos 5 to vetted partners, a US export control directive barred access for any foreign national, inside or outside the country. Since nobody can verify nationality on every request in real time, the result was blunt: both models went dark for the entire planet overnight, while everything else kept running. Less than three weeks later, the controls came off; Fable returned globally and Mythos was restored to a vetted set of US organizations.

Your most capable model is now something a government can switch off with a letter. A policy decision, executed overnight, worldwide.

We're not here to argue whether that was a good use of export controls. What we can tell you is that within days, 76 senior security leaders signed an open letter at freefable.org asking for the control to be lifted. Their argument contended that these models are good at finding and fixing flaws, but they’re not uniquely good at it, and yanking the best supervised model away from defenders while attackers keep racing makes tomorrow less secure.

Katie Moussouris read the research behind the directive, and put it simply: what the model did was the “find, fix, and test” loop defenders run every single day, not some exotic guardrail bypass, and you can't strip that out without making the model worse at defense. Her line is the one to carry into any policy room: we can't export-control our way to cyber resilience.

We've seen this movie before, too. When the Wassenaar Arrangement added controls on "intrusion software" in 2013, the language was so broad it swept up vulnerability disclosure and incident response, the exact defensive work it was never meant to touch.

Here's what this all means in practice:

• Most frontier models come from a single country. If your program is wired to one of them, a directive from that government is now part of your threat model.
• Open models like GLM ship with no cyber guardrails at all, and with only a handful of serious contenders in this race, writing them off is a mistake. Once the weights are public, anyone can fine-tune them for whatever they want, offensive cyber ops included, and no export control or safety classifier will ever claw that back.
• Threat actors don't apply for export licenses. Restrictions slow the people trying to secure systems far more than the people trying to break them.

Was there a legitimate national security instinct behind the directive? Sure. But restricting one supervised US model doesn't make the capability vanish. The capability just relocates: to GPT-5.5, to Opus and Sonnet, to open-weight models with no brakes, and to whoever is quietly sitting on comparable capability while they watch how this plays out. Other governments will answer in kind, because nobody watches a rival flip a kill switch without going off to build their own. Skip the panic and build model access, sovereignty, and redundancy into your security program now, while it's cheap.

What Can Defenders Do Now?

We live in the defender-program world. It’s not exotic. It's mostly fundamentals with more discipline, plus a couple of functions that are no longer optional.

Start with one rule that we think gets broken by every team that botches AI integration:

AI suggests, the human decides, automation performs.

Heather Barnhart's frameworks for RSAC, which map AI integration onto NIST CSF 2.0 and the forensic lifecycle, make that boundary concrete. Let AI assist Detect and Prepare (anomaly detection, log correlation, IOC triage and enrichment, timeline building, asset inventory, and playbook drafting). Keep Recover, Lessons Learned, legal and evidentiary conclusions, and attribution human-only. The trap is the autonomy gap: finished-looking, confident output can arrive faster than your review process was built for. Design the checkpoint on purpose, before you find out the hard way that you needed one.

A few moves to consider:

• Harden the architecture. Spend less energy on vulnerability whack-a-mole and more on closing attack paths, segmentation, and identity. Remember the ExploitGym result: mitigations significantly dropped exploit success. Architecture that assumes breach and contains it wrecks the attacker's economics, whether or not the attacker is a frontier model.
• Stand up VulnOps, and build it, don't buy it. VulnOps (the vulnerability-side cousin of DevOps, coined by Gadi Evron and Bruce Schneier, with Heather Adkins sounding a similar warning) is a permanent, partly automated function that continuously finds flaws across your whole estate and feeds remediation, with triage discipline baked in from day one. There's no turnkey product for it. Also watch for triage fatigue, the direct successor to patch fatigue: don't pour budget into discovery while starving remediation, or you've just built a faster machine for flooding your own backlog.
• Treat the model as a revocable dependency. Own a model inventory and model redundancy function. If you wired a single frontier model into your workflows, you're one outage, deprecation, or directive away from it going dark. June’s export control proved the point.
• Stop flying blind with your agents. When you run a coding agent (Claude Code, Codex, whatever), you usually have no idea what it's doing in the background: which tools it called, what files it read, which bash commands it ran, or what it connected to. You're flying blind, and that agent brings its own supply chain of servers, skills, and config that inherit your developers' access. Sandbox them, and hold them to least-agency. This is the exact problem that my coauthor Thomas Roccia built Nova Hunting to solve: full execution tracing of an agent session so you can hunt across it, because you can't defend what you can't see.

If you're using AI, so are threat actors. The asymmetry is cultural, and teams that won't put AI on defense can't keep pace with the ones putting it on offense.

What Does That Mean for the Industry?

AI is becoming part of national strategy and cyber policy. The temporary US restrictions on Fable and Mythos showed us how things can change overnight because of a policy decision. Security teams should treat model availability and jurisdiction as operational risks when building workflows that can survive provider changes or access restrictions.

For the rest of 2026, we are watching whether Mythos expands past the vetted US organizations, whether the jailbreak severity framework becomes a triage standard, and how quickly open weight models can close the capability gap. That'll tell you more than another benchmark leaderboard, because it decides who can use these systems, on whose terms, and for how long.

Don't read Mythos as the AI apocalypse. But consider it as one sign that cybersecurity competition is becoming faster and increasingly influenced by policy. The next big disruption probably comes from a harness, not a model. For defenders, the priority is to separate real capability from hype and build adaptable workflows before the next shift lands.

Forget the model. Follow the workflow.

Appendix: References and Resources

• Anthropic, Claude Mythos Preview announcement.
• Anthropic, Project Glasswing partner program.
• Cloudflare, testing cyber frontier models.
• Anthropic, Claude Fable 5 and Mythos 5 announcement.
• XBOW, how an autonomous system topped HackerOne's US leaderboard.
• Google Project Zero, From Naptime to Big Sleep.
• DARPA, AI Cyber Challenge results.
• Anthropic, zero-day research using Opus 4.6 (500+ high-severity vulnerabilities).
• AISLE, twelve OpenSSL vulnerabilities discovered.
• Sysdig, AI-assisted cloud intrusion reaching admin access in eight minutes.
• Synthesizing Multi-Agent Harnesses for Vulnerability Discovery, arXiv preprint.
• ExploitGym exploit-development benchmark, arXiv preprint.
• Raptor, open-source autonomous researcher tooling on GitHub.
• Z.ai, GLM 5.2 release.
• Anthropic, Fable and Mythos access update (the export-control directive).
• Anthropic, redeploying Fable 5 (controls lifted).
• freefable.org, open letter from 76 security leaders.
• Luta Security (Katie Moussouris), The Fable 5 Export Controls Harm US Cyber Defense.
• WIRED, Dangerous AI Models Are Coming No Matter What.
• SANS, RSAC 2026 conference recap.
• Schneier on Security, Autonomous AI Hacking and the Future of Cybersecurity.
• Cloud Security Alliance and SANS, AI Vulnerability Storm briefing (v0.95).
• Forrester, How Fable 5 and Mythos 5 Change AI Security, Data Retention, and Vendor Risk.
• TrueFoundry, on the Fable and Mythos access ban.
• Security Break, Nova Hunting agent execution tracing.