Mythos Claude Leak: A Discord group found a way to bypass Anthropic's security / CheapToken News

Published on April 22, 2026 at 11:58
Updated on April 23, 2026 at 10:52

Comment

Claude Mythos, the model that Anthropic wanted to keep out of reach, has fallen into the hands of a group of mysterious internet users. Since the day of the announcement, they have been using the generative AI without Anthropic's knowledge. The startup had everything planned to protect Claude Mythos, but its precautions were not enough to prevent a new leak.

Last week, Anthropic unveiled Claude Mythos, a powerful AI model designed to uncover security flaws in computer code. The American startup quickly realized that its model was also capable of designing methods to exploit the discovered vulnerabilities.

These offensive capabilities emerged naturally as the model gained mastery in programming, logical reasoning, and autonomy. During an internal test, it would have even managed to escape its testing environment, contact a researcher who had gone to lunch, and publish details of its exploit on public websites to prove what it is capable of.

Fearing that malicious individuals might use Mythos to launch cyberattacks, Anthropic decided to restrict access to the model. It was not made available to the general public. The company preferred to reserve artificial intelligence for carefully selected partners under the "Project Glasswing." Companies such as Amazon, Apple, Broadcom, Cisco, CrowdStrike, Google, Linux Foundation, Microsoft, and NVIDIA can use Mythos. Anthropic recommends that its partners use the new version of Claude to patch all vulnerabilities in their tools.

Also read: Inspired by Anthropic, OpenAI launches its dedicated cybersecurity ChatGPT

How did users manage to access Claude Mythos?

Unfortunately, it turns out that mysterious individuals managed to bypass Anthropic's restrictions to access Claude Mythos. As reported by Bloomberg, this group infiltrated Anthropic's system on April 7th, the same day as the announcement. Citing an internal source and screenshots as evidence, the media claims that the intruders come from a Discord server dedicated to hunting for unannounced AI models. They notably use bots to collect information on Anthropic or other AI giants, including on sites like

To achieve their goals, they first tried everything to guess the online address where Mythos was hosted. They based themselves on the format used by Anthropic for its other models and managed to locate the AI through a series of steps. Then, they exploited the access rights of a group member employed by a third-party subcontractor working for Anthropic. The intrusion therefore mainly relies on a supply chain attack, which involves exploiting the weakest link in the chain.

According to the information shared by the media, the intruders also used the information that resulted from the data leak of another provider employed by Anthropic, Mercor. This startup specializing in AI model training collaborates with several major laboratories.

Also read: A 'large-scale cyberattack' based on AI was thwarted by Anthropic

No malicious intent

In response to the concerning revelations by the media, Anthropic did not delay in reacting. The AI giant states that an investigation has been launched regarding 'unauthorized access to Claude Mythos Preview via one of our third-party provider environments'. The company has no evidence that the fraudulent access extended beyond its provider's system.

The source interviewed by Bloomberg states that the group was simply trying to « play with new models », without any malicious intent. The intruders may have used Mythos for several days, without ever launching a single cyberattack. The group also has access to a bunch of other Anthropic AI models, still not disclosed.

All signs point to the fact that Mythos has not fallen into the hands of cybercriminals… for now. If these users managed to bypass Anthropic's defenses, hackers could do the same. In fact, hackers may have already exploited Mythos without Anthropic realizing it. Beyond « questions about the security of this tool, it's a much broader issue for the entire industry that has come to light : AI is now capable of finding vulnerabilities and exploiting them so quickly that defenders could end up completely overwhelmed », explains Stefanie Schappert, a cybersecurity expert. If « such a tool were to be adopted by malicious hackers, security teams would have to completely rethink their work methods, deciding what to prioritize repairing — without even having the guarantee of containing the damage »

Repeated data leaks at Anthropic

Indeed, one will recall that Anthropic has been the victim of a myriad of data leaks in recent months. Following errors or negligence, the complete source code of Claude was posted online, as well as confidential information about future Anthropic projects. Before its release, the existence of Claude Mythos had indeed been widely leaked.