Anthropic Restricted Claude Mythos to Forty Approved Companies Because the Model Is Too Dangerous for Public Release. A Discord Group Got Access on Launch Day Through a Third-Party Contractor and Has Been Using It Continuously for Two Weeks. The "Restricted Release" Approach Failed for the Same Reason Every Other AI Security Story This Month Failed: The Vendor Layer.

TL;DR

On April 21, Bloomberg News reported that a small group operating through a private Discord forum gained unauthorized access to Anthropic's Claude Mythos Preview on the same day the model was publicly announced. The group includes an individual currently employed at a third-party contractor working with Anthropic. They located the model by guessing its URL using Anthropic's known naming conventions for other models, assisted by data from a separate breach at AI training startup Mercor. They have been using the model continuously since gaining access and provided Bloomberg with screenshots and a live demonstration. Anthropic confirmed the investigation but stated there is no evidence the activity extended beyond the third-party vendor environment. The breach matters because Mythos was specifically restricted to forty approved Project Glasswing partners (Amazon, Apple, Google, Microsoft, Cisco, JP Morgan Chase, and others) precisely to prevent this outcome. Mozilla used Mythos to find and patch 271 Firefox vulnerabilities. The model identified a 27-year-old vulnerability in OpenBSD. Treasury Secretary Scott Bessent convened senior US bankers to discuss it. Australian and South Korean financial regulators raised systemic risk concerns.

The takeaway

The "too dangerous to release" model just got released anyway, through the same vendor pattern that has defined every major breach this month.

Day 1

Breached on launch

Approved Glasswing partners

Weeks of unauthorized use

Vendor

Same pattern, different victim

WHAT HAPPENED

On April 7, Anthropic announced Claude Mythos Preview as part of Project Glasswing. We covered the announcement on April 14. The model is described as autonomously capable of finding zero-day vulnerabilities across every major operating system and web browser. Anthropic stated it is too powerful to release publicly because it could be weaponized against corporate security rather than used to defend it. Project Glasswing limited preview access to roughly forty technology and infrastructure organizations including Amazon, Apple, Google, Microsoft, Cisco, JP Morgan Chase, Goldman Sachs, Citigroup, Bank of America, and Morgan Stanley.

Bloomberg News reported on April 21 that a small group of unauthorized users gained access to Mythos on the same day the model was publicly announced. The group operates through a private Discord channel that focuses on gathering intelligence about unreleased AI models. They located the Mythos endpoint by guessing the URL based on familiarity with Anthropic's URL formatting conventions for other models. The guess was informed in part by data from a separate breach at AI training startup Mercor that provided clues about Anthropic's deployment patterns.

The access was facilitated, at least in part, by an individual currently employed at a third-party contractor working with Anthropic. Vendors with penetration testing access had their shared accounts and API keys exploited by unauthorized users. The group has been using Mythos continuously since gaining access and provided Bloomberg with proof in the form of screenshots and a live demonstration of the software. Anthropic confirmed the investigation. "We are investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments. There is currently no evidence that Anthropic's systems are impacted, nor that the reported activity extended further than the third-party vendor environment."

THE PATTERN

This is the third major vendor-cascade breach we have covered this month. On April 22 we wrote about three incident responders at two cybersecurity firms pleading guilty to working with BlackCat while representing victims. This morning we covered Everest's leak of Frost Bank and Citizens Financial Group data, with both banks attributing the breach to a shared third-party vendor. Earlier this month we covered the Anodot Snowflake integration compromise that cascaded into Rockstar Games and produced the ShinyHunters 78 million record dump.

The Mythos breach fits the same architectural shape. The protected target (Anthropic's most powerful model) was not directly compromised. The vendor with privileged access was. The compromise propagated from the vendor environment to access on the protected resource. The defender had hardened the front door. The attacker walked through the side entrance.

What makes the Mythos case especially sharp is that the entire restricted-release strategy was designed to prevent exactly this outcome. Anthropic could have released Mythos publicly and absorbed the resulting risk. They chose to limit access specifically because the model is dangerous in unauthorized hands. The vendor layer defeated that strategy. Forty approved partners became forty approved partners plus one Discord forum. The intent was containment. The result was containment that did not contain.

WHAT MAKES THIS CASE DIFFERENT

The Mythos breach is not a financial loss. The Discord group has not, by any reporting available to date, used the model for cyberattacks. They describe themselves as interested in playing with new AI models, not weaponizing them. By itself, two weeks of curiosity-driven access to a research preview is not a worst-case scenario.

The worst case is what this breach signals about the next breach. If a private Discord forum could guess the URL and walk in through a contractor environment on launch day, then sophisticated state-aligned threat actors with substantially more resources, more patience, and more strategic interest in the model's capabilities are presumed to have access already. Tony Lindner, quoted in Fortune, made the point directly: "If some random Discord online forum got access to it, it has already been breached by China." The reasoning is straightforward. State actors do not announce themselves through Bloomberg with screenshots. They use the access quietly to find vulnerabilities they can weaponize against the targets they care about.

Mythos has demonstrated capabilities that are not theoretical. Mozilla used a preview to identify and patch 271 vulnerabilities in Firefox earlier this month. The model found a 27-year-old security vulnerability in OpenBSD, an operating system specifically engineered for security and audited by experienced reviewers for nearly three decades. CVE-2026-5194 in wolfSSL, an encryption library used in billions of devices, was identified through Mythos research. Whoever has access to a model with this capability can run it against any software they want to attack. The vulnerabilities it finds become attacker tooling if they reach the wrong hands before the patches ship.

POLICY AND REGULATORY CONTEXT

The political and regulatory weight of this breach is also worth understanding. Treasury Secretary Scott Bessent convened a meeting of senior American bankers in Washington on April 16 specifically to discuss the Mythos model and its systemic risk implications. Financial regulators in Australia, South Korea, and several EU nations have raised concerns. Japan's Financial Services Agency, Bank of Japan, National Cybersecurity Office, major banks, and Japan Exchange Group announced a financial cyber taskforce on April 24 in response to model-linked systemic risk concerns.

The Trump administration position is also evolving. President Trump said on CNBC the day before the Bloomberg breach report that a Pentagon deal with Anthropic was "possible" and that the company was "shaping up." Anthropic is simultaneously suing the Department of Defense over its blacklisting as a supply chain risk, with the dispute centered on how safely Anthropic's AI can be controlled. The Discord access undercuts Anthropic's position in that lawsuit. Demonstrating "this model is safely controlled" is harder when the breach predates the litigation.

Sam Altman, OpenAI's CEO, called Anthropic's promotion of Mythos "fear-based marketing" earlier this week. The Mozilla and OpenBSD vulnerability finds make that critique harder to sustain. Mythos either has the capabilities Anthropic claims, in which case the Discord access is genuinely concerning, or the marketing is overblown, in which case Anthropic has a different problem with regulators and policymakers who are responding as if the capabilities are real.

WHAT DEFENDERS SHOULD UNDERSTAND

1
Restricted release is a vendor management problem, not a technical one. If you are protecting a sensitive system by limiting access to approved partners, the security of the system is now the security of every partner's environment combined. Anthropic restricted Mythos access to forty companies. The breach happened through one contractor at one company. Your sensitive systems are exposed at the level of your weakest vendor's controls.
2
URL guessing is a real attack vector for protected resources. The Discord group did not break Anthropic's authentication. They figured out where the model was hosted by combining knowledge of Anthropic's naming conventions with data from a separate Mercor breach. Defense in depth requires that knowing where a system is hosted does not provide meaningful access. If your security model relies on obscurity of endpoint URLs, you have already lost.
3
Audit shared accounts and API keys at every vendor with access to your environment. Bloomberg specifically noted that vendors with penetration testing access had their shared accounts and API keys exploited. Shared credentials in vendor environments are a common operational shortcut and a routine source of compromise. Per-individual credentials with proper logging and revocation processes are not optional for sensitive access.
4
Assume access logs do not show you the unauthorized activity. The Discord group has been using Mythos for over two weeks. Anthropic only learned about the access from Bloomberg's reporting. Vendor environments often have less robust logging and monitoring than the protected systems they connect to. If you are protecting a high-value resource, the monitoring on the vendor side has to match the monitoring on your side, or you will not see the access pattern.
5
The vendor compromise pattern will keep happening. Three weeks of breach reporting at Atarus has documented this pattern across financial services, AI, gaming, and ransomware response. The architectural shape is consistent. Attackers go after the vendor because the vendor is softer than the target. Until the industry treats vendor environments with the same security rigor as production environments, this pattern will continue. Plan accordingly.

ATARUS ASSESSMENT

The Mythos breach is the most ironic security story of 2026. Anthropic specifically restricted access to its most powerful AI model because the model is dangerous in unauthorized hands. The restricted release was the safety control. The vendor layer defeated the safety control on launch day. The Discord group has been running queries against the model for over two weeks while Anthropic, Treasury, financial regulators, and the AI policy community have debated systemic risk implications of a tool that already had a side channel to whoever wanted access. The pattern is not specific to Anthropic. It is the same pattern that took down Frost Bank, Citizens Financial Group, Rockstar Games, the Anodot Snowflake integration, and the ransomware negotiation industry. The vendor layer is where the security model breaks. For organizations watching this story, the lesson is not that Anthropic made a unique mistake. The lesson is that any sensitive resource you protect through vendor relationships is exposed at the level of your weakest vendor's controls. Restricted release as a safety strategy assumes the vendors can be trusted to maintain the security boundary. The Mythos case demonstrates what happens when that assumption fails. The next major breach will follow the same architectural pattern. The vendor that connects to the protected resource will be the access path. The defenders who survive this period are the ones who have already audited their vendor security posture against the assumption that a sophisticated actor will go after the contractor before they go after the prime.