Anthropic probes unauthorized access to Claude Mythos

Anthropic is examining allegations that a limited number of people obtained unauthorized access to its advanced AI model, Claude Mythos, according to a report dated April 21, 2026. The claims center on activity in a private forum, where users were said to have reached the model without the usual permissions.

 

The reported pathway was not described as a conventional intrusion. Instead, the access was characterized as a misuse of existing permissions, with the report pointing to a third-party vendor environment as the likely route. Anthropic said it currently has no evidence that its core systems were compromised.

 

Claude Mythos is described as a cybersecurity-focused tool that Anthropic has judged too capable for broad public distribution. The company has limited availability to select technology and financial firms, with the stated aim of helping those organizations strengthen defenses and improve system security. The alleged incident has therefore drawn attention to how access controls are managed when powerful AI capabilities are shared in restricted settings.

 

The episode lands amid wider debate about how to secure highly capable AI systems and the environments that host them. The report’s framing—permission misuse rather than a direct “hack”—highlights a risk area that can sit outside traditional perimeter defenses, particularly when third-party systems and delegated access are involved.

At the same time, Anthropic’s statement that it lacks evidence of compromise to its core systems leaves key questions unresolved about the scope of any exposure and what data or capabilities, if any, were reachable through the alleged access.

 

Separately, the issue aligns with recent public remarks from Richard Horne, head of the UK’s National Cyber Security Centre (NCSC). Speaking at the CyberUK conference, Horne said advanced AI tools could be a net positive if they are secured properly. He also warned that frontier AI can quickly surface existing weaknesses, reinforcing the need for strong cybersecurity fundamentals.

 

For markets and policymakers, the situation underscores the operational and governance challenges that come with deploying frontier AI in sensitive domains such as cybersecurity. It also places attention on vendor management and permissioning practices, especially where AI models are distributed to a narrow set of corporate users.

What remains uncertain, based on the information provided, is the extent of the alleged access, how long it may have persisted, and whether any additional controls will be adjusted as Anthropic continues its investigation.