Anthropic Model's Reported Breach in Simulated NSA Test Within Hours Raises Security Concerns

Anthropic has positioned Claude Mythos 5 as its most powerful cybersecurity model, making its capabilities and access controls consequential for critical infrastructure protection and AI governance. With the public-facing Fable 5 still blocked, the gap between government and civilian access to advanced models has fueled controversy over technological monopolies and double standards.

Anthropic recently announced that Mythos 5 had been cleared to come back online, but only for certain US critical infrastructure organizations, with no access for the general public. Fable 5 remains blocked. Anthropic did not disclose the exact announcement date, the number of authorized organizations or any financial amounts involved, prompting criticism from the online and open-source communities that it is using AI risks to entrench national and technological advantages.

Mythos and Fable are Anthropic’s latest AI models. The Trump administration intervened over national security risks and concerns that their safety guardrails could be jailbroken. The episode underscores government concerns about frontier-model capabilities, technology leakage and the progress of Chinese open-source AI. It has also intensified tensions between Washington’s regulatory authority and Silicon Valley’s autonomy in research and development.

The U.S. government ordered Anthropic to withdraw Mythos and Fable entirely within 90 minutes on the day the order was issued. Anthropic subsequently stopped offering both models. The U.S. Commerce Department also imposed strict licensing controls on the models. Reports have not disclosed the order’s exact date, any penalties or transaction amounts, while market attention has shifted to the potential opportunities for open-source and decentralized AI.

Anthropic has introduced Claude Mythos, also known as Fable 5, touting stronger code-analysis and vulnerability-detection capabilities. Such models can help defenders patch smart contracts but may also lower the technical barriers to launching cyberattacks, fueling concerns in the crypto community about the security of assets and protocols.

Anthropic said the new model includes general-purpose safety safeguards and routes cybersecurity-related queries to a specialized model to reduce the risk of misuse. The Uniswap founder, however, criticized the design of its “safety filter” as poorly calibrated. Related reports did not disclose the exact release date, any losses or the value of assets affected.

Anthropic is targeting Japan’s cybersecurity market with its next-generation AI model Claude Mythos, focusing on vulnerability detection and pursuing Japanese government agencies and financial institutions. The strategy raises questions about cross-border reliance on critical computing power and cybersecurity capabilities. It has also drawn the U.S. government’s attention to computing sovereignty, prompting Japan to accelerate development of advanced domestic cybersecurity models.

As of July 20, 2026, the latest reports indicate that Anthropic is aggressively positioning itself in Japan’s government and financial markets, with Claude Mythos’s vulnerability-detection capabilities emerging as a key competitive focus. The Japanese government and industry are simultaneously advancing the development of sovereign models. Available information does not disclose the model’s release date, investment amount, procurement scale or any formal partner institutions.

macOS isolates applications through kernel permissions and multiple layers of security. If those protections are bypassed, attackers could gain elevated system privileges. Cybersecurity research firm Calif combined Anthropic’s internal Mythos AI model with human experts to analyze the system, underscoring generative AI’s growing ability to tackle complex vulnerability research.

In 2026, Calif’s team had Mythos identify a way to bypass macOS security protections and uncover a privilege-escalation vulnerability within five days. The flaw was subsequently designated CVE-2026-28952 and affects the macOS 26.5 kernel. Apple has received the report and begun verification, while the related acknowledgments also credit Anthropic’s Claude with discovering the vulnerability.

Anthropic is developing its flagship Claude Mythos model with advanced coding, reasoning and autonomous cybersecurity capabilities. Its ability to rapidly chain vulnerabilities together could lower the barrier to cyberattacks, making the leak more than a product-secrecy issue. It also raises concerns about zero-day exploitation, responsible disclosure mechanisms and the defense of critical infrastructure worldwide.

As of July 19, 2026, Anthropic was investigating unauthorized access caused by a system configuration error. Reports said vulnerabilities could be attacked within as little as four hours of disclosure. The company is not making Mythos broadly available for now, instead prioritizing trials by cyber defense organizations and addressing risks through its Glasswing program and threat-intelligence sharing.

Anthropic’s Mythos AI model is positioned as a system with advanced cybersecurity capabilities. But its powerful offensive and defensive tools could also be misused, drawing scrutiny from the European Commission and financial regulators. Anthropic has pledged to comply with the EU’s AI Code of Practice, assess the model’s risks and take steps to mitigate them.

EU officials have now met with Anthropic for a briefing on cybersecurity concerns surrounding Mythos, while euro-area finance ministers have separately raised requirements concerning bank access. Available information does not disclose the exact date of the meeting, the number of banks affected or any transaction amounts. Attention will now turn to access permissions and risk-control standards.

Anthropic’s new Claude Mythos model has demonstrated a strong ability to identify software vulnerabilities. It could help companies and researchers patch systems, but could also be misused to rapidly find weaknesses and expand cyberattacks. The issue is shaping the direction of U.S. AI regulation and testing the balance between model innovation and national cybersecurity.

The White House is concerned that Claude Mythos could be used in large-scale cyberattacks, according to the latest reports. The Trump administration is considering moving away from its relatively hands-off stance and requiring new AI models to undergo government security reviews and standardized testing before release. No implementation date, thresholds, responsible agency or related budget has been announced.

Anthropic’s Mythos is its latest AI model and has not yet been made widely available. Reports say it focuses on advanced cybersecurity capabilities. The incident is significant because the exposure of a restricted model through a supply-chain environment could reveal its capabilities, access controls and customer data, deepening concerns about the risks companies face when adopting generative AI.

As of July 19, 2026, Anthropic was investigating reports of unauthorized access to Mythos. Hacker group ShinyHunters claimed it had breached the model and released screenshots of dashboards and user data. Initial evidence pointed to a third-party vendor environment, with no indication that Anthropic’s own systems were affected. The number of affected accounts, volume of data involved and financial losses have not been disclosed.

The Trump administration blacklisted Anthropic and restricted federal agencies from using its technology after the company insisted that AI should not be deployed in weapons systems. Yet Anthropic’s models remain strategically valuable in cybersecurity and software development and are still being evaluated internally, highlighting a policy conflict between national security needs and AI safety principles.

US media recently reported that the Commerce Department, congressional committees and some federal officials had circumvented the ban to privately test the cyberattack and coding capabilities of Anthropic’s most powerful model, Mythos, and receive related technical briefings. The reports did not disclose the exact dates of the tests, the committees involved or any associated amounts. The restrictions arising from Anthropic’s blacklisting remain in place.