Anthropic’s red team previewed Claude Mythos, which apparently spent its weekends discovering thousands of previously unknown security flaws across operating systems, browsers, and cryptographic libraries. Highlights include a 27-year-old OpenBSD SACK bug that lets a remote attacker crash any OpenBSD host over TCP and a 16-year-old FFmpeg H.264 flaw, while separate findings were chained into multi-stage exploits (one browser exploit strung four bugs together) without human babysitting. OpenBSD had already shipped the fix as errata 025 for 7.8, which sums it up as “TCP packets with invalid SACK options could crash the kernel.” Anthropic does not plan to make the model generally available and instead gives it to Amazon Web Services, Apple, Google, Microsoft, the Linux Foundation and other partners through Project Glasswing, backed by up to $100M in usage credits. Patching teams may want to start filing tickets in advance.
