In late March 2026, a Fortune report based on a leak from Anthropic's content management system (the software companies use to draft and publish their blog posts) revealed Claude's upcoming model.

Someone at Anthropic uploaded draft marketing material and "accidentally" made it public.

Among the material was a draft blog post that described a new tier of model, internally code-named "Capybara," which was described as larger and more intelligent than Opus, with dramatically higher scores in software coding, academic reasoning, and cybersecurity.

The leaked materials mentioned a delay in the model's release, citing that its improvements in coding and reasoning posed a threat to current technology infrastructure.

Why?

It was supposedly as good as or better than the best cybersecurity engineers in the world, and during testing was able to find hundreds of security vulnerabilities across packages, operating systems, and browsers.

On April 7, Anthropic confirmed the speculation and announced Mythos, alongside Project Glasswing, which is a $100M commitment to work with some of the world's largest companies to secure critical software.

This could all be an amazing marketing stunt to hype up the capabilities of the model or to compound on Anthropic's recent success in positioning itself as the virtuous and trustworthy AI company (with their whole positioning with the Department of War).

From the outside, we don't know the extent of the risk, but the rational thing to do is to take it seriously.

I am sure Project Glasswing will identify major vulnerabilities, but I am concerned about the companies which have not been given access to the project, which make up the vast majority of the internet. There are hundreds of thousands of pieces of critical software across the world, many of which have seen no changes in years and have no team constantly maintaining them, but that are underpinning real-world infrastructure, which will be extremely vulnerable (if not by Mythos, then by future models).

While it is hard to imagine, having worked at places that are supposed to be at the forefront of technology, you quickly realize that fast progress demands building on top of weak foundations (turtles all the way down).

I know this problem has only become more prevalent, as the barriers to software creation have come down and there is now a constant pressure to ship more and more (leading to what Karpathy called AI psychosis).

While it is true those same models can be used by companies and individuals to secure their software, I question whether there is currently enough capital allocated, or enough human know-how, to do so. While people like to tout the autonomous ability of these models, they still require a very capable human in the loop to set up the harness and infrastructure for the models. Mythos itself was run in a loop thousands of times by Anthropic researchers to identify the security vulnerabilities they have cited.

On the capital allocation side, it is hard to imagine company CEOs across the board, who don't have a good sense of how far AI has come in programming, having the foresight to use AI to harden their systems. It is also an investment that doesn't promise great upside, it simply minimizes the downside.

The outputs of Project Glasswing itself could be dangerous, if they are too detailed in explaining the vulnerabilities they found, that could be the lowest-hanging fruit for hackers to go after the same vulnerabilities against similar companies which aren't part of the project. For example, any vulnerability in Stripe could be the first thing hackers target for large payment processors in Latin America.

This is scary, as I see a very real future where major data leaks and hacks give the anti-AI-ers greater legal basis to pursue frontier labs and stunt innovation.

There is also a geopolitical dimension. As we have seen drone technology and its implementation on the battlefield shift the balance of power, giving outsized influence to small non-state actors and smaller militaries that rely on affordable mass, the same dynamic could play out with offensive AI.

Recognizing the looming threat, I am trying to get smarter on cybersecurity, and having recently been accepted into Anthropic's cybersecurity verification program, I have been testing Opus's defensive capabilities.

SINGULARITY

Get new memos by email