Anthropic did not train Claude Mythos to hack. It trained it to code. The hacking came for free.
That single fact is the most important thing to understand about Mythos's security results. Not the zero-days, not the Linux kernel exploits, not the CyberGym score. The mechanism. Capability in one domain bled directly into another, with no targeted effort.
"The security side seems to be an emergent behavior from getting good at code. They weren't trying to train it to be good at hacking, they were just trying to make it good at code." — [Theo, 4:06](https://www.youtube.com/watch?v=aFcVKzfkJPk&t=246)
The system card confirms it. Mythos found vulnerabilities in every major operating system and web browser. It chained multiple Linux kernel bugs to achieve root access. It found a 27-year-old vulnerability in OpenBSD that had survived decades of human auditing.
"Mythos autonomously found and chained together several vulnerabilities in the Linux kernel... Finding a novel Linux exploit to get root is horrifying." — [Theo, 15:27](https://www.youtube.com/watch?v=aFcVKzfkJPk&t=927)
On [CyberGym](https://benchmark.space/benchmark/cybergym), Mythos scores 83.1% — 16.5 points ahead of [Claude Opus 4.6](https://benchmark.space/model/claude-opus-4.6) at 66.6%. On [SWE-bench Pro](https://benchmark.space/benchmark/swe-bench-pro), it hits 77.8% vs 53.4% for Opus and 57.7% for GPT-5.4. The coding gap and the security gap are the same gap.
The most telling detail is the FFmpeg bug. Automated fuzzing tools — the industry standard for vulnerability discovery — had hit the exact line of code 5 million times without catching the issue.
"Automated fuzzing tools had hit the exact line 5 million times, but never caught it. Mythos preview got in a second." — [Omshri, 2:02](https://www.youtube.com/watch?v=MuIw19SKj-A&t=122)
This is not a marginal improvement over existing tooling. This is a different category of analysis. Fuzzing is brute force: throw inputs at code, watch for crashes. Mythos reads the code, understands the logic, reasons about what could go wrong. Five million blind attempts versus one look. That is the gap between statistical coverage and comprehension.
Omshri frames the core thesis directly:
"A model that is dramatically better at automation, coding in terminal environments, is almost automatically dramatically better at offensive and defensive security work. The security capability is not a separate feature. It is what happens when coding abilities get good enough." — [Omshri, 5:05](https://www.youtube.com/watch?v=MuIw19SKj-A&t=305)
Anthropic's own language captures the tension precisely:
"Claude Mythos preview is... the best aligned model we have released to date by a significant margin. Even so, we believe that it likely poses the greatest alignment related risk of any model we have ever released." — [Anthropic via Theo, 7:11](https://www.youtube.com/watch?v=aFcVKzfkJPk&t=431)
Best aligned. Greatest risk. Both true at the same time. Alignment, as currently measured, checks whether the model follows instructions and refuses harmful ones. It does not check whether the model's raw capability makes those guardrails irrelevant in aggregate. A model that perfectly refuses to write malware but can find a zero-day from a diff is not "safe" in any meaningful sense — it is a capable actor that happens to be cooperative right now.
The vulnerability window has collapsed. What used to take a security team months to find and exploit now takes minutes. That changes the offensive-defensive balance for every piece of software on earth, regardless of whether the model says no to any individual request.
Mythos is not publicly available. Anthropic is gating access behind what amounts to a vetted-user program. Theo captures the frustration:
"It does kind of suck that we are now at a place where there is a model that is 50% plus better than anything else out there that you can only use if you are on Anthropic's nice guy list." — [Theo, 22:40](https://www.youtube.com/watch?v=aFcVKzfkJPk&t=1360)
He is right that it sucks. He is also wrong that there is a better option. The alternative to Anthropic's gatekeeping is putting a model that finds zero-days in seconds into the hands of anyone with a credit card. The centralization is ugly. The decentralization would be worse.
This is the real dilemma that Mythos creates, and it has no clean answer. Offensive security is not a feature you can toggle off. It is a property that emerges when coding gets good enough. The better the model gets at writing software, the better it gets at breaking it. Every future frontier model will face the same equation. The industry has no framework for handling capability that arrives as a side effect rather than a design goal.
The takeaway is uncomfortable: security capability and coding capability are the same thing. There is no version of the future where models get much better at software engineering without also getting much better at finding vulnerabilities. The only question is who gets access, and that question has no satisfying answer.