Good morning,

We cover the actual launch of Claude Mythos, two weeks after the "leak" that introduced it, and what a deliberately withheld frontier model means for cyber risk. Plus the usual top news roundup including an interesting FT piece on the Data Center slowdown.

On April 7, Anthropic formally released Claude Mythos Preview. They did not, however, release it to the general public — and they have no plan of doing so, ever.

To appreciate why that sentence is unusual, start with what the model is. Per Anthropic's technical report, Mythos sets a new state of the art on every major public benchmark it was tested on (reasoning, mathematics, general knowledge, coding) sitting above the Claude Opus 4.7 flagship released nine days later (itself at 87.6% on SWE-Bench Verified). In a nutshell, as of now, Mythos is the single most capable language model ever built.

Initially developed with the intent of pushing programming proficiency further, Mythos turned out to be exceptional at one aspect of computer science in particular: finding and exploiting cybersecurity vulnerabilities. In pre-release testing, the model independently discovered previously unknown zero-day vulnerabilities across every major operating system and web browser family. (A zero-day is a bug the vendor has neither patched nor catalogued. It is the single most valuable category of security finding; individual zero-days routinely trade for six- to seven-figure sums on grey markets.) One illustrative finding from the UK AI Security Institute (AISI) evaluation: Mythos chained a memory-corruption bug in a widely deployed browser component with a admin privilege-escalation flaw in a mainstream OS to construct, from scratch, a working remote-code-execution exploit. This is the kind of capability a nation-state red team might develop over months. More broadly, AISI verified that Mythos can execute a 32-step corporate-network attack end-to-end — reconnaissance, initial access, lateral movement, privilege escalation, exfiltration, all autonomously. In plain terms: Mythos can either take control of a target system or shut it down.

Consider that implication for a moment. Every stock exchange in the world runs on software. So does every payments network, every clearinghouse, every SWIFT terminal, every treasury management system. These are hardened environments — but none of them were designed against an adversary that could discover and weaponise zero-days in industrial quantities, at machine speed, cheaply. A Mythos-class model in the wrong hands is not a cybercrime tool; it is a systemic financial-stability concern. Anthropic told senior US officials, in writing, that its model would make large-scale cyberattacks materially more likely in 2026 if it were widely accessible. Cybersecurity stocks fell 1.6% on the signal, bringing the S&P 500 software and services index to a YtD of -26%.

This is why there is no public release, and it is why Project Glasswing came to existance. Glasswing is Anthropic's name for the gated-defence programme that now distributes Mythos. Access is restricted to roughly eleven vetted partners, among which Apple, Google, Microsoft, Cisco, Nvidia and JPMorgan . The bet is defensive asymmetry: let defenders use Mythos first, to surface and patch the vulnerabilities it can find, before comparable capability proliferates elsewhere.

Understandably, the political engagement around Glasswing has been intense. On 17 April, Dario Amodei met White House Chief of Staff Susie Wiles, Treasury Secretary Scott Bessent, and the National Cyber Director to walk them through Mythos. The UK AI Safety Institute published its full technical evaluation within days. The EU AI Office, by contrast, was not among the forty organisations granted pre-release access — an awkwardness Brussels has yet to answer for.

Seven days after Glasswing, OpenAI answered with GPT-5.4-Cyber, a cyber-tuned variant distributed under a similar restricted-access model.

Does Glasswing buy the world much time? Dario Amodei, in an interview with the Financial Times last week, said he expects open-source models — most plausibly from China — to match Mythos's capabilities within six to twelve months. He is probably right. Z.ai's GLM-5.1, released on 7 April (open sourced) has already topped SWE-Bench Pro edging GPT-5.4, Claude Opus 4.6 and Gemini 3.1 Pro. Meaning Glasswing is a bridge to ensure smooth transition, not a wall.

Why it matters: Mythos is arguably the most significant technology event of 2026 so far. It raises important societal and security questions, and for insurance it casts serious doubt on how cyber risk can be priced. How can we put a price on it if it is reasonable to assume that many customers could see their systems toppled by a simple LLM prompt? LLMs pose a greater cybersecurity threat than purely human hacker groups ever have. However, as Project Glasswing suggests, LLMs will also enable stronger testing and security. For insurers, this technology is simultaneously a major source of risk and a requirement for any company seeking cyber insurance.