2026-04-21 · 2026-Q2
Anthropic Claude Mythos Preview Accessed by Discord Group via Vendor Breach
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
Anthropic Claude Mythos Preview (cyber-offensive AI model held back under Project Glasswing limited-partner program)
Impact
A small private Discord community gained continuous access to Mythos starting on launch day (April 7, 2026) by guessing the preview URL pattern, drawing on operational details from a Mercor breach three weeks earlier; group has not used Mythos for cyberattacks but has retained access; Anthropic stated it is investigating "unauthorized access to Claude Mythos Preview through one of our third-party vendor environments"
Root cause
A third-party contractor with operational knowledge confirmed URL guesses based on Anthropic's prior naming conventions; access controls relied on URL secrecy at the vendor environment rather than authenticated tenancy; Mercor breach context fed the recon
Sources
Catalog
Cite this: AgentProv incident record: Anthropic Claude Mythos Preview Accessed by Discord Group via Vendor Breach (2026-04-21). https://agentprov.com/incidents/2026-04-21-anthropic-claude-mythos-preview-accessed-by-discord-group-via-vendor-breach
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run