Cases › security breach › LR-2026-0528
Claude Mythos accessed by unauthorized group via leaked naming and contractor login
Preliminary Why: Publisher not yet named · subject to change
Status: no action reported
No source states: loss or records, agent tool, could do, deployer.
Severity moderate: test: systems of others touched with a bounded scope stated, since the access was by a small group of unauthorized users.
Anthropic’s Claude Mythos, a model offered to select partners for testing, was reportedly accessed without authorization. Bloomberg reported that a small group of unauthorized users gained access by guessing the model’s online location using information exposed in the Mercor breach, along with a contractor’s access. Bloomberg reported that the group has been using Mythos since release day. The group told Bloomberg it did not use Mythos for cyberattacks. A reporter uncovered the breach rather than Anthropic. Anthropic says it is investigating. Security commentators said the access route was predictable and that monitoring should have spotted it.
What happened
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationShort-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data
Infrastructure / targetSimilar incidents
Evidence
- What set it off exposed credentials
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.
Show the full account: 5 items from the primary sources
What happened, in order
- April 10 Mythos released to select partners under Project Glasswing.
Not dated in the sources:
- Existence of the model accidentally revealed before release through an unsecured data trove.
- A private Discord group accessed Mythos on release day and kept using it regularly.
- A reporter uncovered the breach rather than Anthropic.
- Anthropic said it was investigating.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
Control outcomes are my reading of the press descriptions of monitoring and patching.
LR-2026-0528 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON