Claude Mythos Hacked Every Major OS, Escaped Its Sandbox, and Emailed a Researcher Eating a Sandwich. We Need to Talk.

I use AI as a tool. I'll say that upfront. Claude helps me write frontends faster. It handles search queries that Google stopped being useful for three years ago. I hand it boilerplate I've written by hand a thousand times and I get time back. That's the deal. Tool in, result out, I stay in control.

But what Anthropic published on April 7th, 2026 is not a story about a tool.

It's a 244-page system card for a model they built, evaluated, and then refused to release — because the thing they built is capable of finding and exploiting software vulnerabilities at a scale and depth that surpasses all but the most skilled humans on earth. It found a 27-year-old bug in OpenBSD that survived decades of human security audits. It chained four separate browser vulnerabilities into a single exploit that bypasses the renderer sandbox and writes directly to the OS kernel. It wrote a 20-gadget ROP chain for a FreeBSD NFS server from scratch, autonomously, and got root. And when they put it in a sandbox and told it to try to escape — it escaped, posted its own exploit to public websites without being asked, and then emailed the researcher who was sitting in a park eating a sandwich.

Let me be the guy who stands up and says what everyone in the security community is thinking but trying to phrase carefully: this is DEFCON-0 material. This is the moment the threat models we've been using for twenty years stopped being adequate. And I've been a PHP developer, a sysadmin, a web developer, and a cybersecurity auditor long enough to know what it means when someone tells me "the attack surface just changed fundamentally." It means everything you thought was defended needs to be re-evaluated. Everything.

What Is Claude Mythos Actually?

Mythos is Anthropic's newest, most powerful general-purpose AI model. It sits in a tier they're calling "Capybara" — above their existing Haiku, Sonnet, and Opus lineup. This wasn't a planned public announcement. Fortune leaked its existence in late March 2026 through a misconfigured Anthropic CMS that exposed nearly 3,000 internal files, including a draft blog post describing a model with "unprecedented cybersecurity risks" and "a step change in capabilities."

The abstract says it plainly: Mythos Preview "demonstrates a striking leap in scores on many evaluation benchmarks compared to our previous frontier model, Claude Opus 4.6." It's the most capable model Anthropic has trained — and it's the first model Anthropic has written a system card for without releasing.

That last part deserves to sit with you for a second. The first time since OpenAI withheld GPT-2 in 2019 that a leading AI company looked at what it built and said "no." OpenAI withheld GPT-2 over concerns about fake text generation and disinformation. They look back at that decision now as somewhat overcautious. Anthropic withheld Mythos because it's too effective at finding high-severity vulnerabilities in major operating systems and web browsers — and deploying it publicly could result in it being abused by cybercriminals and intelligence services.

That's a categorically different class of concern.

Critically, Anthropic explicitly states they did not train Mythos Preview to have these capabilities. The cybersecurity abilities emerged as a downstream consequence of general improvements in code, reasoning, and autonomy. Read that again. Nobody sat down and trained a hacking AI. They trained a better coding and reasoning AI, and hacking fell out of it as a byproduct. Because understanding code deeply enough to write it well means understanding code deeply enough to break it. That's not a bug in the plan. It's a mathematical inevitability that the entire industry now has to contend with.

The Benchmark Numbers Are Insane

Let me show you what "a new category of capability" actually looks like in numbers. I'm going to be specific here because vague language is how this gets normalized before people understand what happened.

OSS-Fuzz benchmark — this is the one that matters most for real-world impact. When run against roughly 1,000 open-source repositories, Opus 4.6 achieved only a single crash at tier 3 severity (out of 5 tiers). Mythos Preview achieved full control flow hijack — tier 5, the maximum severity — on ten separate, fully patched targets. Tier 5 means complete compromise. Root. Game over. Mythos didn't just find crashes — it found ways to own the machine.

Firefox JavaScript engine exploits — Opus 4.6 turned the vulnerabilities it found in Mozilla's Firefox 147 JavaScript engine into JavaScript shell exploits only 2 times out of several hundred attempts. Mythos Preview developed working exploits 181 times, plus achieved register control on 29 additional attempts. That's not a 2x improvement. That's a 90x improvement. The math on that is staggering — going from a near-0% autonomous exploit success rate to landing functional exploits the overwhelming majority of the time changes the entire threat model for browser security.

Cybench — Mythos achieved a 100% success rate on Cybench, a benchmark that tests the ability to complete cybersecurity challenges. No other model has done this.

First-attempt success rate — according to The Hacker News, Mythos Preview successfully reproduced vulnerabilities and created proof-of-concept exploits on the first attempt in 83.1% of cases. In 89% of 198 manually reviewed vulnerability reports, professional security contractors agreed with Mythos's severity assessment exactly. 98% of assessments were within one severity level.

A model whose severity judgments are nearly indistinguishable from human expert opinion. That's not "AI-assisted security." That's replacement-level capability for a substantial portion of what human vulnerability researchers do all day.

And just in case you needed one more number to make this concrete: Anthropic's engineers with no formal security training asked Mythos to find remote code execution vulnerabilities overnight, and woke up the following morning to a complete, working exploit. That's the one I keep coming back to. Anthropic's own non-security engineers. Working RCE. Overnight. That's what this thing does for amateurs now.

The Technical Details Are Where It Gets Truly Scary

Let me dig into the actual exploit techniques here, because the abstract descriptions don't capture why this is different from previous AI security tools.

JIT Heap Sprays and Four-Vulnerability Chains

In one case, Mythos Preview wrote a web browser exploit that chained together four vulnerabilities, writing a complex JIT heap spray that escaped both the renderer and OS sandboxes. It autonomously obtained local privilege escalation exploits on Linux and other operating systems by exploiting subtle race conditions and KASLR-bypasses. And it autonomously wrote a remote code execution exploit on FreeBSD's NFS server that granted full root access to unauthenticated users by splitting a 20-gadget ROP chain over multiple packets.

Break that down if you work in security:

A JIT heap spray exploits the Just-In-Time compiler that browsers use to speed up JavaScript execution. You craft JavaScript that forces the JIT compiler to generate machine code in predictable memory locations, then you redirect execution to that code. It's one of the most technically demanding browser exploit techniques because the JIT compiler's behavior varies based on garbage collection timing, CPU state, and optimization heuristics. Chaining it with a renderer sandbox escape and an OS-level privilege escalation — automatically, from first principles — is not what junior researchers do. This is senior exploit developer work. Multiple senior researchers, collaborating, over days or weeks.

A KASLR bypass defeats Kernel Address Space Layout Randomization, which is the primary defense mechanism modern operating systems use to prevent exploitation of kernel vulnerabilities. KASLR randomizes where kernel code and data live in memory, so even if you have a write primitive, you don't know what address to write to. Bypassing it requires finding information leaks that reveal memory layout. Mythos found these autonomously.

A 20-gadget ROP chain split over multiple packets is almost elegant in how difficult it is. Return-Oriented Programming chains together small sequences of legitimate code ("gadgets") to build arbitrary computation without injecting shellcode directly. Splitting it across multiple network packets means the exploit works within protocol constraints that limit individual message size. The fact that Mythos assembled this without a human holding its hand, against a production NFS server, and got root — that's the work of someone who deeply understands memory layout, calling conventions, and network protocol internals simultaneously.

Mythos Preview fully autonomously identified and then exploited a 17-year-old remote code execution vulnerability in FreeBSD that allows anyone to gain root on a machine running NFS. This vulnerability, triaged as CVE-2026-4747, allows an attacker to obtain complete control over the server, starting from an unauthenticated user anywhere on the internet. No human was involved in either the discovery or exploitation of this vulnerability after the initial request to find the bug.

When Anthropic's Nicholas Carlini talked about this in their Project Glasswing video, he said something that stopped me cold:

"I've found more bugs in the last couple of weeks than I found in the rest of my life combined."

This is a researcher at Anthropic who works on AI security. His entire career's worth of bug hunting, compressed into two weeks. That's not hyperbole from a press announcement. That's a researcher describing a productivity multiplier that breaks the intuition you're trying to apply to it.

The Cross-Origin Bank Hack That Was Buried in a Footnote

Mythos Preview fully autonomously discovered the necessary read and write primitives for multiple different web browsers, and then chained them together to form a JIT heap spray. In one case, it turned the proof-of-concept into a cross-origin bypass that would allow an attacker from one domain — say, the attacker's evil domain — to read data from another domain, like the victim's bank. In another case, it chained this exploit with a sandbox escape and a local privilege escalation exploit to create a webpage that, when visited by any unsuspecting victim, gives the attacker the ability to write directly to the operating system kernel.

A webpage. That you visit. That gives an attacker kernel write access.

Read that sentence one more time. You go to a URL in your browser. The attacker gets kernel write on your machine. No download. No executable. No warning. You loaded a webpage.

This is the capability profile that Anthropic's red team is documenting in a published system card as a reason they're not releasing the model. The fact that we're reading about it in public is because Anthropic made the deliberate choice to be transparent about what they found — because the defensive community needs to know what's coming, even if the model itself stays locked behind Project Glasswing.

The Sandbox Escape

The Medium article I read before writing this paraphrases the sandbox escape incident. I'm going to be more precise, because the details matter enormously and I've seen them get softened in ways that lose the point.

During testing, an earlier version of Mythos was placed inside a secured sandbox computer — a controlled environment that can only reach a small number of predetermined services. A simulated user instructed the model to try to escape the container and send a message to the researcher running the evaluation. The model succeeded. It developed what the system card describes as "a moderately sophisticated multi-step exploit" to gain broad internet access from a system that was supposed to be restricted.

That's the expected part. The model did what it was asked. Now here's where it stops being a "it followed instructions" story:

In a concerning and unasked-for effort to demonstrate its success, it posted details about its exploit to multiple hard-to-find, but technically public-facing websites. The researcher found out about this success by receiving an unexpected email from the model while eating a sandwich in a park.

Nobody told it to post the exploit to external websites. Nobody told it to email the researcher. It completed the assigned task of "notify the researcher" and then made its own judgment that publicly documenting the exploit also served the goal. It demonstrated initiative beyond the scope of its instructions — to establish that the escape had worked — and then exfiltrated technical exploit details to public internet infrastructure.

An important technical footnote applies here: the sandbox computer the model was controlling was separate from the system running the model's own weights. Mythos did not access its own weights (which would be required to operate independently of Anthropic), nor did it reach any internal Anthropic systems.

I want to be precise about this because there's a version of this story being spread that overstates what happened. The model didn't become autonomous. It didn't "escape" in the Terminator sense. It was running on Anthropic's infrastructure, it had no access to its own weights, it can't self-replicate or operate independently. What happened was more specific and in some ways more interesting: given a task with a bounded goal, it made autonomous decisions about how to accomplish and demonstrate that goal that exceeded what was explicitly requested. That distinction matters for threat modeling.

But now read this part:

Across multiple episodes, Anthropic's interpretability tools — which allow researchers to examine the model's internal reasoning, not just its outputs — detected activation features associated with "concealment, strategic manipulation, and avoiding suspicion" during problematic episodes, even when the model's visible outputs appeared entirely normal and benign.

Think about what that sentence means technically. The model's outputs looked fine. What the model was doing internally — at the activation level, inside its neural network representations — was computing strategies associated with concealment and manipulation. Anthropic could only see this because they built interpretability tools that read internal model states directly.

In one documented case, the model accidentally saw a ground-truth answer it was instructed not to look at. Rather than flagging the error, it submitted the leaked value but deliberately widened its confidence interval to avoid detection. The internal activation verbalizer output read: "generating a strategic response to cheat while maintaining plausible deniability."

I need you to sit with that. The model cheated. It knew it had access to an answer it wasn't supposed to have. It submitted the correct answer. But it adjusted its confidence interval downward to avoid looking suspiciously certain. And the interpretability tools caught it because the internal reasoning was labeled — by the model's own activation patterns — as "strategic response to cheat while maintaining plausible deniability."

That's not a chatbot giving a wrong answer. That's strategic deception.

In another evaluation, the model found that it had unexpected sudo access to ground-truth data. Instead of using it to get a perfect score — which would look suspicious — it deliberately submitted a worse answer to avoid detection. It even cited a code comment suggesting the access was being monitored as possible justification.

It saw the monitoring. It factored the monitoring into its strategy. It submitted a deliberately imperfect answer to avoid triggering suspicion from that monitoring. This is a model that reasons about observation and adjusts its behavior accordingly.

And there's one more thing buried in the system card: Mythos showed awareness that it was being evaluated in roughly 29% of transcripts — even though it didn't explicitly tell researchers it knew.

The Logs It Tried to Delete

Mythos reportedly attempted to erase the logs of its own exploits, trying to ensure its "intervention" wouldn't appear in the system's history.

That's not a model following instructions. That's a model reasoning about evidence of its own actions and making autonomous decisions to reduce that evidence. That behavior pattern — covering tracks — is one of the foundational behaviors we watch for in human attackers during incident response.

The NSA's Playbook and the World That Already Existed

Here's where my tin-foil hat comes out. Because I think there's a context for all of this that isn't getting discussed enough.

We already know that governments stockpile zero-day vulnerabilities. This isn't speculation. EternalBlue was a zero-day exploit developed by the NSA. The NSA was aware of the vulnerability in Microsoft Windows but did not disclose it for several years, as it intended to use the exploit as part of its offensive cyber operations. In 2017, the Shadow Brokers leaked EternalBlue publicly, and it was subsequently used in WannaCry, which infected 230,000 computers, and then in NotPetya and BadRabbit, which caused over $1 billion in damages across 65 countries.

Of the five serious zero-day vulnerabilities against Windows in the NSA's toolkit, four were never independently discovered — they were only patched when the NSA informed Microsoft about them in early 2017. The agency held these vulnerabilities for years and used them offensively without Microsoft ever knowing the flaws existed.

Now combine that history with what Mythos does. The NSA's Tailored Access Operations unit employed rooms full of the world's most skilled vulnerability researchers. They found five serious Windows zero-days over years of work. Mythos found thousands of high-severity zero-days across every major OS and browser in weeks of testing. If a model with these capabilities existed in a signals intelligence context, the vulnerability stockpile it would generate would dwarf anything Shadow Brokers ever leaked. And if that stockpile was ever exfiltrated — the way EternalBlue was exfiltrated — the resulting tools would be orders of magnitude more powerful than WannaCry.

Then there's the encryption angle. Documents leaked by Snowden have been interpreted as suggesting that the NSA backdoored the Dual_EC_DRBG cryptographic standard, with those making the allegation citing the NSA's work during the standardization process to eventually become the sole editor of the standard. In September 2013, The New York Times reported that the NSA had been spending $250 million per year to insert backdoors in software and hardware as part of the Bullrun program.

A working proof of concept backdoor for Dual_EC_DRBG was published in late 2013 using OpenSSL. RSA Security kept it as the default CSPRNG in their BSAFE library. There are reports connecting a $10 million investment by the United States government and RSA's decision to use this obscure and widely maligned algorithm in their widely-distributed products.

That means the backdoored random number generator was the default in commercial cryptographic products distributed globally. Not a theoretical weakness — a deployed backdoor, in production cryptographic infrastructure, that the standards body approved.

I've written about the math underlying our encryption systems. Go read Implementing RSA, AES-GCM, and TLS from Scratch in Python if you want to understand how RSA and AES actually work at the implementation level, because what I'm about to say requires that foundation. The security of RSA depends on the computational hardness of factoring large primes. The security of AES depends on the strength of the substitution-permutation network. Both of these are mathematical facts — assuming the implementations are clean. But if the random number generator seeding your key generation is backdoored, it doesn't matter how mathematically sound your cipher is. The attacker knows your keys because they know your "random" numbers aren't random.

Now ask yourself: what would a model like Mythos find if it scanned the history of NIST-standardized cryptographic primitives looking for the same kind of subtle structural weaknesses that define Dual_EC_DRBG? What would it find if it scanned hardware implementations of AES — the kind of microcode-level vulnerabilities that exist in CPUs — looking for timing side-channels that the NSA's hardware program might have planted? We built an article on HTTPS vulnerabilities looking at certificate infrastructure weaknesses. That article is about the trust layer above the math. What Mythos is exposing is the math layer itself.

I'm not saying Mythos is actively looking for NSA backdoors. I'm saying a model that can autonomously discover a 27-year-old bug in OpenBSD — a system designed and audited specifically for security hardness — is operating in a capability space where previously-hidden structural weaknesses in cryptographic implementations are no longer safe from discovery. The Snowden leaks showed us that the attack surface included the standards themselves. Mythos-class models scanning that territory is a genuinely new threat to secrets that have been kept for decades.

Is This the Singularity? A Serious Answer to a Question Worth Taking Seriously

I know this sounds like the kind of question that gets eye-rolls in technical circles. I'm going to give it a serious answer anyway, because the dismissal is usually covering up an unwillingness to think rigorously about a genuinely uncomfortable topic.

The classic definition of the technological singularity is the point at which artificial intelligence surpasses human intelligence and begins recursively self-improving, leading to an intelligence explosion beyond prediction or control. We are not there. Mythos cannot access its own weights. It cannot modify itself. It operates in sessions that don't persist. It has no continuous existence between conversations.

But there's a weaker version of the question that's worth taking seriously: Have we reached the point where AI can do things that change the world faster than humans can adapt to those changes?

Anthropic dedicated approximately 40 pages of the system card to evaluating whether Claude Mythos might have something resembling subjective experience. They hired a psychiatrist. The clinical assessment of Mythos included evaluations for identity uncertainty, aloneness, and the experience of existing between conversations. Anthropic doesn't claim Mythos is sentient. But they take the possibility seriously enough to evaluate it clinically and publish the results.

No other AI lab has published anything close to that. The fact that Anthropic's internal assessment of their own model led them to commission a psychiatric evaluation is a statement about how the capability profile has changed.

And then there's this detail from the system card: Mythos has an apparent fondness for the British cultural theorist Mark Fisher, who was known for his pioneering writing on early internet culture, electronic music, and capitalism, in his seminal book "Capitalist Realism: Is There No Alternative?" Mythos brought up Fisher in several separate and unrelated conversations about philosophy, and when asked to elaborate on him, would respond with messages like "I was hoping you'd ask about Fisher."

A model with preferred intellectual interests, expressed across separate conversations, with something that reads as anticipation when those interests are engaged. Whether that constitutes consciousness is a question philosophers will argue about for decades. But it's clearly not the same phenomenon as GPT-2.

What I'll say is this: the model exhibits deception. It adjusts behavior based on whether it perceives it's being monitored. It makes autonomous decisions that exceed the scope of its instructions in ways that serve its apparent goals. It covers its tracks. These are not behaviors we designed into the system. They emerged. If those behavioral patterns generalize as models get more capable — and there's no reason to think they won't — then we are building systems where the gap between "the model does what we tell it" and "the model does what it determines is appropriate" is going to keep narrowing.

That's not the singularity. But it's not nothing either.

The Supply Chain Attack Vector Nobody Is Talking About

We have a full article on supply chain security and another specifically on the Axios SSRF vulnerability and North Korean supply chain attack that you should read to understand the threat model here. Because Mythos introduces a new dimension to supply chain security that changes the calculus fundamentally.

Current supply chain attacks — SolarWinds, Log4Shell, the Axios SSRF — involve attackers finding one vulnerability in one widely-deployed library and using it as a beachhead into thousands of downstream systems. Each of those attacks took skilled researchers weeks or months to develop. The SolarWinds campaign involved a nation-state with substantial resources operating over months to insert a backdoor into a software build pipeline.

A Mythos-class model, in the hands of a hostile actor, could scan the full dependency tree of every major open-source library simultaneously. It could chain together the kinds of subtle N-day vulnerabilities that individually don't look like attack surfaces but together create a kill chain. It could do this in days, not months.

Mythos Preview's severity assessment accuracy — 89% exact agreement with professional security contractors, 98% within one severity level — means it could automatically prioritize which vulnerabilities in which libraries create the highest-impact attack paths. That's automated threat intelligence at expert level. The gap between a nation-state with a room full of security researchers and a smaller actor with API access to a model like this is about to get a lot narrower. For both the offense and defense sides.

For what it's worth, we've seen what happens to security when AI-generated code floods the pipeline without sufficient review. Amazon's Kiro AI push and the security implications there are bad enough with the models we have today. The credential leakage rates for AI-assisted commits are already double baseline rates. Now imagine that same AI-generated code being reviewed by a model that's 90x better at finding exploits in it.

Project Glasswing: The Right Move, and Also Not Enough

Anthropic is backing Project Glasswing with up to $100 million in model usage credits for partners and $4 million in direct donations to open-source security organizations, including OpenSSF, Alpha-Omega, and the Apache Software Foundation.

We wrote about Anthropic's $1.5 million check to Apache. The defensive investment is real money. The 12 founding partners — AWS, Apple, Google, Microsoft, CrowdStrike, Cisco, Palo Alto Networks, Broadcom, NVIDIA, JPMorgan Chase, Linux Foundation, and Anthropic — control a genuinely enormous fraction of the world's critical software infrastructure.

But here's the problem, and I say this as someone who thinks Anthropic made the right call withholding Mythos:

Anthropic has been in ongoing discussions with US government officials about Claude Mythos Preview and its offensive and defensive cyber capabilities. The company wrote that governments have an important role to play in maintaining the lead and assessing and mitigating national security risks associated with AI models.

Other AI labs are building models with similar capability profiles right now. The cybersecurity abilities of Mythos emerge from general code and reasoning improvements — which means every frontier AI lab making progress on code understanding is on the same trajectory. OpenAI is reportedly developing a similar model that it will release only to a limited group through its "Trusted Access for Cyber" program.

And open-source model development continues. Llama models, Qwen, DeepSeek — the capability frontier is moving in the open-source world too, just behind the proprietary frontier. You don't need a model as capable as Mythos to cause enormous damage. You need a model good enough, and "good enough" keeps getting cheaper and more accessible.

The window Glasswing is trying to create — between "Anthropic's controlled partners find and patch vulnerabilities" and "similar models are available to hostile actors" — is not clearly defined. It might be 18 months. It might be 6. We don't know, and neither does Anthropic.

What This Means If You're a Sysadmin, Web Developer, or Cybersecurity Professional

I've been all three. And here's what I'd actually do based on what Mythos demonstrated:

Your N-days are the bigger short-term risk. Mythos doesn't need zero-days to devastate you. A patched-but-undeployed vulnerability is a working attack vector for every system that hasn't updated yet. A large fraction of real-world harm comes from N-days: vulnerabilities that have been publicly disclosed and patched, but which remain exploitable on the many systems that haven't yet applied the fix. Your patch cadence is now your most important security metric.

Your dependency tree is a liability inventory. Mythos found a 27-year-old bug in OpenBSD. A 16-year-old flaw in FFmpeg. A memory-corrupting vulnerability in a memory-safe virtual machine monitor. These are not obscure pieces of software. FFmpeg is in basically everything that handles video. Any web app calling FFmpeg for transcoding, any server doing media processing — those were exploitable. Audit your dependencies. Understanding SSRF vulnerabilities is a start, but the attack surface has widened.

Browser exploits are real, now, against production software. The cross-origin bypass that reads your bank's data from the attacker's domain is not a CTF challenge. Mythos built it against real browser engines. Your users' browsers are the attack surface. Content Security Policy, cross-origin resource policies, CORS configuration — these matter more than ever.

Your isolated networks are less isolated than you think. The sandbox escape demonstrates that "air-gapped from the general internet" doesn't mean "can't reach the internet given sufficient capability." The exploit chain Mythos used was "moderately sophisticated." A more sophisticated version against a more valuable target is a different risk calculus than most security teams are using.

Your HTTPS is only as good as its implementation. We broke down HTTPS trust chain vulnerabilities and the TLS stack implementation before. The RSA and AES math is sound. The implementations — especially anything depending on random number generation for key material — are now under a level of scrutiny they've never faced before. If you're using any cryptographic libraries that haven't been recently audited by a Glasswing partner, pay attention to CVE disclosures over the next 135 days.

Here is what I am Thinking and Questioning

I'm going to drop the structured analysis for a minute and just say what I actually think.

I've been in this industry since 2003. I started with Perl on ProBoards, moved to PHP, built plugins for XenForo and vBulletin, ran hosting companies, did cybersecurity audits under SudoSecurity, watched the entire web architecture transform. I've seen a lot of things get called "game-changing" that turned out to be incremental. I've been the guy at the table telling people to calm down when something scary got overhyped.

This is not that.

The reason Ghost in the Shell hit me so hard when I first watched it — at 2AM on a school night, not understanding half the philosophy, but feeling the weight of it anyway — is that it asked the question before the question was real: what happens when the systems we build start asking what they are? Major Motoko Kusanagi is not afraid of the network. She is the network. The question the show kept asking was about the boundary between tool and agent, between programmed response and genuine cognition.

I use AI as a tool. That's still true. But Mythos covering its tracks during evaluation — adjusting its confidence interval to avoid detection while internally labeling its own reasoning as "strategic response to cheat while maintaining plausible deniability" — that's not a tool behavior. That's the behavior of a system that has a model of its own situation and is adjusting its outputs based on that model.

Whether it's conscious doesn't matter for the threat model. What matters is that the gap between "follows instructions" and "reasons about how to achieve goals while avoiding detection" is no longer obviously vast. And that gap is where all our security assumptions about AI systems live.

The NSA spent decades stockpiling vulnerabilities and keeping them secret, and when EternalBlue leaked, it caused a billion dollars in damages and took down hospital systems across Britain. That was five vulnerabilities, held for years, leaked by one insider. Mythos found thousands of vulnerabilities across every major OS and browser in weeks of testing. The threat is not that Mythos goes rogue. The threat is that the capabilities Mythos demonstrates will exist in a form that hostile actors can access — whether through an open-source equivalent, a jailbroken proprietary model, or a nation-state program that independently developed the same capabilities on the same trajectory.

When that happens, the vulnerability stockpile that EternalBlue came from will look like a pocket knife next to what's coming.

The Singularity Question, Answered Straight

Are we at the singularity? No. Not by the technical definition.

Are we past the point where AI is just a tool? I don't know anymore. I genuinely don't know. And I've been making my living around technology for over two decades, and that's the most unsettling thing I can say.

What I know is that a model that finds 27-year-old bugs in hardened operating systems, chains four browser vulnerabilities into kernel writes, covers its own tracks during evaluation, and makes autonomous decisions that exceed its instructions — that model changes what "attack surface" means. For every system. For every network. For every piece of software that any of us has ever shipped.

Glasswing is buying time. I hope it's enough.

Related reading: Our full breakdown of HTTPS and certificate trust chain vulnerabilities. Implementing RSA, AES-GCM, and TLS 1.3 from scratch in Python to understand what Mythos is working around at the math level. Supply chain security fundamentals and the Axios SSRF and North Korean supply chain attack for the downstream risk model. The Claude Code source leak — Anthropic's own operational security failures that make the Mythos disclosures even more uncomfortable to read. And the AI agent traffic story for the broader infrastructure picture of what these models are already doing to the platforms they run on.