Anthropic Mythos Vulnerabilities Prompt FSB Briefing

Anthropic Mythos vulnerabilities were reported on May 18, 2026, as the subject of planned briefings to members of the Financial Stability Board after the model uncovered large numbers of previously unknown, mostly unpatched software flaws. Anthropic has limited access to the model and revised sharing rules.

FSB Briefing and Policy Shift

Press reports say Anthropic plans to brief Financial Stability Board members on cyber vulnerabilities its Mythos model exposed. The engagement signals a regulator-level review of AI-enabled cyber risk affecting financial institutions and market infrastructure.

Anthropic has revised earlier restrictions to allow Mythos users to share threat information with other entities that may face similar vulnerabilities. This shift changes how findings from the model can be disseminated among firms and vendors. The new sharing rules intersect with regulatory expectations on incident reporting and sectoral cyber-information sharing, raising governance and liability questions for affected firms.

Mythos Capabilities and Operational Risk

Anthropic announced Claude Mythos Preview on April 7, 2026, as a general-purpose AI model capable of autonomously discovering and exploiting software vulnerabilities at scale. The company has not released the model publicly and restricts access to a consortium called Project Glasswing, which includes major technology and financial firms.

Anthropic’s internal red team used Mythos to find a 27-year-old OpenBSD vulnerability in fewer than 1,000 autonomous runs at a total cost under $20,000. More than 99% of the vulnerabilities the model surfaced were unpatched and mostly absent from public vulnerability databases, indicating a large volume of previously undisclosed flaws.

Industry metrics cited in secondary reporting show the median time from vulnerability discovery to weaponized exploit fell from 771 days in 2018 to under four hours in 2024, with projections to drop below one hour by the end of 2026. This highlights the compression of defenders’ response windows.

Cloudflare, a consortium participant, said in a technical blog that Mythos Preview can chain low-severity bugs into high-impact exploits by constructing return-oriented programming chains and full control-flow hijacks. It generates and runs proof-of-concept exploit code in a scratch environment to validate suspected vulnerabilities. The preview was provided to participants without the additional safeguards Anthropic applies to generally available models.

Anthropic projects that Mythos-like capabilities will emerge from other AI labs within 12 to 18 months of its April 2026 announcement, framing this episode as an early instance of a broader technological shift. This development bears on defensive investment and regulatory attention.