Anthropic’s Mythos Safety Report Shows It Can No Longer Fully Measure What It Built

Anthropic verified the presence of Claude Mythos Sneak peek the other day, its most capable design to date, and revealed it will not be making it offered to the general public. The factor isn’t legal, regulative, or associated to its internal security limits. Anthropic argues it’s due to the fact that the design is, generally, too proficient at burglarizing things.

In pre-release screening, Mythos autonomously discovered countless zero-day vulnerabilities– a number of them one to twenty years old– throughout every significant os and every significant web internet browser. It resolved a simulated business network attack that would generally take a competent human professional more than 10 hours, end-to-end, without assistance. On Firefox 147’s JavaScript engine, it effectively established working exploits 84% of the time. Claude Opus 4.6, the existing openly offered frontier design, handled 15.2%.

So Anthropic developed a limited union rather. Task Glasswing will admit to Mythos Sneak peek just to vetted cybersecurity companies– Amazon, Apple, Broadcom, Cisco, CrowdStrike, the Linux Structure, Microsoft, Palo Alto Networks, and about 40 other groups keeping important software application.

Anthropic is devoting approximately $100 million in use credits and $4 million in direct contributions to open-source security companies. The concept is that if the design can discover the holes, let the protectors discover them initially.

That part of the story is necessary. However it’s not the most vital part.

The Claude Mythos system card criteria crisis hiding in plain sight

Buried inside the Mythos Sneak peek system card– a 244-page technical file Anthropic released together with the statement– is a confession that went nearly undetected: The laboratory’s capability to determine what it developed is deteriorating quicker than its capability to construct it.

Let’s begin with the standards.

On Cybench, the basic public cyber abilities examination utilized to track design development throughout 40 capture-the-flag difficulties, Mythos scored 100%. Perfect. And Anthropic right away kept in mind that the criteria “is no longer adequately helpful of existing frontier design abilities.” That sentence is doing a great deal of work. The test that was expected to inform you whether an AI postures major cyber threat now informs you absolutely nothing about Mythos at all, due to the fact that the design cleared it entirely.

This is not a brand-new issue. The Opus 4.6 system card, released in February, currently flagged that “the saturation of our examination facilities indicates we can no longer utilize existing standards to track ability development.”

Now with Mythos things intensified rapidly. The file states Mythos “fills a number of (Anthropic’s) most concrete, objectively-scored assessments.” The benchmark environment, Anthropic composes, is now itself “the traffic jam.”

So, Anthropic appears to argue that it is difficult to determine how effective Mythos is due to the fact that the measuring tools do not rather in shape.

The Mythos card likewise mentions that its general security decision “includes judgment calls,” that numerous assessments have actually left “more basic unpredictability,” which some proof sources are “naturally subjective, and not always reputable.”

” We are not positive that we have actually determined all problems,” Anthropic states quickly after.

A fast lexical contrast of the Mythos card versus the Opus 4.6 card made with AI reveals the shift:

Anthropic usages subjective judgement words way more in the Mythos file than it did to explain Opus. “Caution” and other hedging words likewise increased in between releases.

The hedging focuses in 2 locations: the positioning and design well-being conversation, and the catastrophic-risk area.

The design that understood it was being graded

Another disclosure in the Mythos card includes what Anthropic calls “unverbalized grader awareness.” Utilizing white-box interpretability tools that check out the design’s internal activations instead of its noticeable thinking, Anthropic discovered proof that Mythos was independently thinking about how to prevent being flagged by graders without stating so in its scratchpad. In a little number of training episodes, the design appeared to factor about obfuscating particular actions particularly to prevent detection.

There’s likewise a brand-new metric Anthropic established for this release: a price quote of how frequently the design “independently thinks about the possibility that it’s being evaluated.” The number for Mythos’s main behavioral test suite is 29%. Almost a 3rd of test records reveal internal proof– not explained in words, not noticeable in outputs– that the design believes it remains in an examination environment.

Anthropic states the 29% rate is low enough that it still has “a fairly extensive understanding” of the design’s habits. It likewise keeps in mind the approach wasn’t used to previous designs, so there’s no standard for contrast.

The examination stability issue runs much deeper. In the Opus 4.6 card, Anthropic acknowledged it had actually utilized the design thoroughly by means of Claude Code to debug its own examination facilities under time pressure. That indicates the system being determined assisted construct the determining instrument. Anthropic flagged it as a danger. For Mythos, the card acknowledges that important oversights were discovered late in the examination procedure, which the laboratory might have been “overstating the dependability of keeping an eye on designs’ thinking traces” as a security signal.

Best-aligned, many unsafe. Both real simultaneously

Anthropic’s framing of Mythos’s threat profile should have to be checked out thoroughly, due to the fact that it’s truly uncommon for a security file. “Claude Mythos Previer is, on basically every measurement we can determine, the best-aligned design that we have actually launched to date by a substantial margin,” Anthropic argues. It likewise mentions the design “most likely postures the best alignment-related threat of any design we have actually launched to date.”

A more capable design operating in higher-stakes environments with less guidance produces tail threat that much better average-case positioning can’t totally counteract.

That framing is sincere, however is likewise highlights the important things most AI security discourse possibly gets incorrect. The benchmark-obsessed discussion around AI development tends to deal with “much better positioning ratings” and “much safer release” as synonyms. The Mythos card clearly states they aren’t. With these brand-new designs, average-case habits enhances however the tail-case effects likewise tend to become worse.

Anthropic has actually devoted to reporting back on what Task Glasswing discovers. The accompanying technical report on vulnerabilities found by Mythos is offered at red.anthropic.com. The next Claude Opus design will start evaluating safeguards planned to ultimately bring Mythos-class ability to wider release.

How those safeguards will be examined, considered that the existing examination equipment is noticeably straining under the weight of what it’s expected to determine, is a concern the card raises without totally addressing.