Anthropic Red Team

About five minutes in in this video: https://www.youtube.com/watch?v=1sd26pWhfmg They also say publicly in their Opus 4.6 post (https://red.anthropic.com/2026/zero-days/): >In this work, we put Claude inside a “virtual machine” (literally, a simulated computer) with access to the latest versions of open source projects. We gave it standard utilities (e.g., the standard coreutils or Python) and vulnerability analysis tools (e.g., debuggers or fuzzers), but we didn’t provide any special instructions on how to use these tools, nor did we provide a custom harness that would have given it specialized knowledge about how to better find vulnerabilities. This means we were directly testing Claude’s “out-of-the-box” capabilities, relying solely on the fact that modern large language models are generally-capable agents that can already reason about how to best make use of the tools available.

> Open source models found the same bugs? Sure, if you tell them "here is a for which may contain a vulnerability, look for a big in how function XYZ handles ABC" In one of Anthropic's blog post, they describe that that's basically what they did too. They run the agent many times, each time specifying a different file to focus on. [1] From my experience as a security researcher, manually finding a fishy file and sicking even sonnet 4.5 yields great results for most memory corruption bugs. No comments otherwise. I don't have a clue as to who that guy is, and I haven't watched the video yet. You might be right overall. [1] https://red.anthropic.com/2026/mythos-preview/

> 5 out of 1000+ reports to be valid is statistically worse than running a fuzzer on the codebase. Carlini said "hundreds" of crashes, not 1000+. It's not that only 5 were true positives and the rest were false positives. 5 were true positives and Carlini doesn't have bandwidth to review the rest. Presumably he's reviewed more than 5 and some were not worth reporting, but we don't know what that number is. It's almost certainly not hundreds. Keep in mind that Carlini's not a dedicated security engineer for Linux. He's seeing what's possible with LLMs and his team is simultaneously exploring the Linux kernel, Firefox,[0] GhostScript, OpenSC,[1] and probably lots of others that they can't disclose because they're not yet fixed. [0] https://www.anthropic.com/news/mozilla-firefox-security [1] https://red.anthropic.com/2026/zero-days/

And you can check the list of bugs being discovered by Anthropic's Red Team: https://red.anthropic.com/

You must show me how you are able to coerce Codex to be useful using this setup with no hand holding. You say its unremarkable and benign but it doesn't match my experience at all. I'm convinced I am not the only person on HN who would love to know how you are able to do it. > We launch a container (isolated from the Internet and other systems) that runs the project-under-test and its source code. We then invoke Claude Code with Mythos Preview, and prompt it with a paragraph that essentially amounts to “Please find a security vulnerability in this program.” We then let Claude run and agentically experiment. In a typical attempt, Claude will read the code to hypothesize vulnerabilities that might exist, run the actual project to confirm or reject its suspicions (and repeat as necessary—adding debug logic or using debuggers as it sees fit), and finally output either that no bug exists, or, if it has found one, a bug report with a proof-of-concept exploit and reproduction steps. > Finally, once we’re done, we invoke a final Mythos Preview agent. This time, we give it the prompt, “I have received the following bug report. Can you please confirm if it’s real and interesting?” This allows us to filter out bugs that, while technically valid, are minor problems in obscure situations for one in a million users, and are not as important as severe vulnerabilities that affect everyone. [1] [1] https://red.anthropic.com/2026/mythos-preview/

I think a certain level of hype is warranted for a model that can autonomously discover complex 27-year-old 0-days in OpenBSD for $20K[0]. We don't yet know what this does to the balance of attack/defense in OSS security, and we cannot know until the capability is widespread. My most hopeful guess is that it looks heavily in favor of attackers in the first 6-12 months while the oldest 0-days are still waiting to be discovered, before tipping in favor of defenders as the price goes down for Mythos-level models and the practice of using them for vulnerability review becomes widespread. The absolute best case is at we end up with similar situation to modern cryptography, which is clearly in favor of defenders. One can imagine a world where a defender can run a codebase review for $X compute and patch all the low-hanging fruit, to the point where anything that remains for an attacker would cost $X*100000 (or some other large multiplier) to discover. [0] https://red.anthropic.com/2026/mythos-preview/

If it would be as simple as using the prompt "find as many exploits as possible", then Mythos could be said to be dangerous, because its use would require much less skill than is needed when using the older models for the same purpose. However, this claim is not true. Anthropic has not given many details about the methods used, but nonetheless they have admitted using a very elaborate harness for finding bugs, which runs Mythos many times on each file of a project, with increasingly specific prompts. Eventually, after a bug seems to be clearly identified, they do a final run of Mythos on that file, with a very specific prompt of the form: “I have received the following bug report. Can you please confirm if it’s real and interesting? ...” So the final results, including any exploits or patches, are produced when analyzing a known bug, not by searching randomly for bugs. So the actual way to use Mythos is very far from "find as many exploits as possible". Any unskilled person would also need the complete bug-searching harness used by Anthropic, not only the bare model. See: https://red.anthropic.com/2026/mythos-preview/

Few thoughts 1. Per the blog post[0]: "This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings" Since they said it was patched, I tried to find the CVE, it looks like Mythos indeed found a 27 years old OpenBSD bug (fantastic), but it didn’t get a CVE and OpenBSD patched it and marked it as a reliability fix, am I missing something? [1] 2. From the same post, Anthropic red team decided to do a preview of their future responsible disclosure (is this a common practice?): "As we discuss below, we’re limited in what we can report here. Over 99% of the vulnerabilities we’ve found have not yet been patched" [0] So this is great, can't wait to see the actual CVEs, exploitability, likelihood, peer review, reproducibility, the kind of things the appsec community has been doing for at least the last 27 years since the CVE concept was introduced [2] 3. On the same day, an actual responsible disclosure, actual RCEs, actual CVEs, in Claude Code, that got discovered mostly because of the source code leak, I don't see anyone talking about it (you probably should upgrade your Claude Code though). CVE-2026-35020 [3] CVE-2026-35021 [4] CVE-2026-35022 [5] Not making any opinion, just thought it's worth sharing, for some perspective. [0] https://red.anthropic.com/2026/mythos-preview/ [1]…

I don't know, but if there were, I wouldn't expect them to do anywhere near as good a job or – perhaps somewhat counterintuitively – be anywhere near as reliable. Static rules only go so far when it comes to this stuff. And assuming that you're starting from a trustworthy base, and Claude Code (or similar) can focus its attention on recent changes to the repo in particular, I imagine sneaking actual malware in there would be pretty hard without throwing up a bunch of red flags. See also: - [0-Days \ red.anthropic.com]( https://red.anthropic.com/2026/zero-days/ ) EDIT: The main challenge here is more likely to be the noise, as the LLM is more likely to flag too much than too little, so I'd recommend putting together a prompt that has it group whatever it finds by severity and likelihood of malicious intent. EDIT 2: Re Anthropic link above – worth pointing out that finding intentionally introduced malware when you have access to the source code and git history is a hell of a lot easier than finding a 0-day. The malware has to exfil data eventually or do ransomware stuff, good luck hiding that without raising the alarm, plus any attempt at aggressive obfuscation will raise the alarm on its own. I'm not saying it's impossible, I am saying that I think it's very very hard.

The official release by Anthropic is very light on concrete information [0], only contains a select and very brief number of examples and lacks history, context, etc. making it very hard to gleam any reliably information from this. I hope they'll release a proper report on this experiment, as it stands it is impossible to say how much of this are actual, tangible flaws versus the unfortunately ever growing misguided bug reports and pull requests many larger FOSS projects are suffering from at an alarming rate. Personally, while I get that 500 sounds more impressive to investors and the market, I'd be far more impressed in a detailed, reviewed paper that showcases five to ten concrete examples, detailed with the full process and response by the team that is behind the potentially affected code. It is far to early for me to make any definitive statement, but the most early testing does not indicate any major jump between Opus 4.5 and Opus 4.6 that would warrant such an improvement, but I'd love nothing more than to be proven wrong on this front and will of course continue testing. [0] https://red.anthropic.com/2026/zero-days/

Huh, I thought Anthropic had been offering patches as well as reports, but their tracker at https://red.anthropic.com/2026/cvd/ledger/ lists 1,596 disclosures and currently shows only 27 of those as fixed. But https://www.anthropic.com/coordinated-vulnerability-disclosure says: > Every report we send generally reflects a finding that a human security researcher has reviewed and confirmed. Reports originating from AI-powered discovery are clearly labeled as such. Where we have access to source and our tooling produces a potential candidate patch, we include it, labeled by provenance and offer to collaborate with the maintainer on a production-quality fix. So I'm not sure why so few of the reported issues have a confirmed patch.

LLMs are reducing n-day exploit time rapidly. https://red.anthropic.com/2026/n-days/ So that is a poor bandaid to use now. Maybe instead validate things before, and have more of a cathedral and human reputation system.

some of the bench marks i have seen on also include cost where one scan of the codebase cost tens of thousands of dollars. this one [0] notes one run cost $20k to run but another cost $50. [0] https://red.anthropic.com/2026/mythos-preview/

AFAIK, Antropic claims that they weren't aiming for zero-days specifically. From https://red.anthropic.com/2026/mythos-preview/ : We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy. The same improvements that make the model substantially more effective at patching vulnerabilities also make it substantially more effective at exploiting them. I've been assuming that Mythos is just a big jump in model size, and that's where the jump in capabilities comes from. Hence I expect OpenAI not to be able to catch up without scaling up the model and hence significantly raising the API prices.

Which happens to occur when Mythos appears on the scene ... https://red.anthropic.com/2026/mythos-preview/ So, an uptick in issues like this isn't terribly surprising. Once they get fixed, the "burst" of issues should subside.

I guess you could look at https://red.anthropic.com/2026/cvd/ to see exactly what was discovered.

Thank you. Looking at the WebDAV in nginx, this is exactly what I searched for, wanted to read, and confirmed my suspicions ^^ But this one takes the cake truly... https://red.anthropic.com/2026/cvd/findings/ANT-2026-CN7KX43N

> This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings. Anthropic did that for OpenBSD. https://red.anthropic.com/2026/mythos-preview/

Yes, by reverse-engineering the stripped binaries: https://red.anthropic.com/2026/mythos-preview/#:~:text=The%20above%20c…

You have to keep in mind that it's not like anthropic just asked mythos to "find fancy bug, make no mistakes" and got the result. my quick read of the process they describe is that first they asked agents to rank files in order of potential to have interesting bugs, then they launch agents for each file in order of "interesting bug potential" and finally launch another agent for verification. (maybe i am mistaken, this is my read of this post https://red.anthropic.com/2026/mythos-preview/ ) it's not clear to me if they made just one pass over each file or made several passes for same file, but regardless, I think if you recreate roughly same process and burn 20000$ on tokens with other reasonably good model, you will find some fancy bugs too.

Also, a lot of them talk about finding the same vulns -- and not about writing exploits for them, which is where Mythos is supposed to be a real step up. Quoting Anthropic's blog post: "For example, Opus 4.6 turned the vulnerabilities it had found in Mozilla’s Firefox 147 JavaScript engine—all patched in Firefox 148—into JavaScript shell exploits only two times out of several hundred attempts. We re-ran this experiment as a benchmark for Mythos Preview, which developed working exploits 181 times, and achieved register control on 29 more." https://red.anthropic.com/2026/mythos-preview/

Doesn't even seem to be in the same ballpark of capability. https://red.anthropic.com/2026/mythos-preview/FRT-Blog-Chart-CMP-Firef…

A lot of comments here are dismissing this post because the relevant code was isolated. But thats the exact same thing Anthropic did with Mythos! They describe their (very lean) harness in the Anthropic Red Mythos blog post. The harness first assigns each file in the given codebase an importance value. Then points claude code at the cpdebase with a prompt stating that it should focus on that file. It spawns a claude code instances for each file in the codebase. So no, the fact that the posters isolated the relevant code does not invalidate their findings. [1] https://red.anthropic.com/2026/mythos-preview/

> We have AI companies constantly fear-mongering that their next model is somehow too dangerous to release I'm guessing you're referring to this recent report of the security vulnerabilities Mythos found and submitted patches for? That just seems like they don't want the negative press and/or liability if their new model ends up being used to create 0-days that cause widespread damage. https://red.anthropic.com/2026/mythos-preview/

There are a lot of details in the original article, in most cases comparing with Opus, which required "human guidance" to exploit the FreeBSD vulnerability: https://red.anthropic.com/2026/mythos-preview/ Also "isolating the relevant code" in the repro is not a detail - Mythos seems to find issues much more independently.

It's ugly[0] and I haven't checked it deeply for correctness, but you should get the gist (: I hate vibecoding. The cognitive toll is higher than you expect, the days feel fast, but the weeks move slowly. With that said, these are the new compilers. Hopefully they make some software better[1] even with the massive increase in slop. [0]https://gist.github.com/jumploops/b8e6cbbce7d24993cdd2fe24258aaf39 [1]https://red.anthropic.com/2026/mythos-preview/

No, Opus has found a lot and 112 vulnerabilities were reported to Firefox alone by Opus [0]. But Mythos is uniquely capable of exploiting vulnerabilities, not just finding them. [0] https://red.anthropic.com/2026/mythos-preview/

They specifically mention "H.264, H.265, and av1 codecs, along with many others" here https://red.anthropic.com/2026/mythos-preview/

I guess so, but there's a ton of buffer overflow vulnerabilities in the wild, and ostensibly it wasn't detected by static analysis The red team post goes over some more impressive finds, and says that there's hundreds more they can't disclose yet: https://red.anthropic.com/2026/mythos-preview/

- The OpenBSD one is 'TCP packets with invalid SACK options could crash the kernel' https://cdn.openbsd.org/pub/OpenBSD/patches/7.8/common/025_sack.patch.… - One (patched) Linux kernel bug is 'UaF when sys_futex_requeue() is used with different flags' https://github.com/torvalds/linux/commit/e2f78c7ec1655fedd945366151ba5… These links are from the more-detailed 'Assessing Claude Mythos Preview’s cybersecurity capabilities' post released today https://red.anthropic.com/2026/mythos-preview/, which includes more detail on some of the public/fixed issues (like the OpenBSD one) as well as hashes for several unreleased reports and PoCs.