Yesterday Anthropic announced that Claude Mythos Preview found thousands of zero-day vulnerabilities across every major operating system, every major web browser, and a range of other critical software. Some of these bugs are over a decade old. One was a 17-year-old remote code execution flaw in FreeBSD that the model found and exploited fully autonomously. Then Anthropic did something unusual. Instead of releasing the model, they locked it down. Project Glasswing gives limited access to AWS, Apple, Google, Microsoft, CrowdStrike, and about 40 other organisations responsible for maintaining critical infrastructure. Everyone else waits. Anthropic is also committing up to $100M in usage credits and $4M in direct donations to open-source security organisations through the Linux Foundation and Apache Software Foundation.

The model is too capable at finding attack surfaces to let it out into the open. That is the story. And I want to believe it. But I have seen this playbook before.

The marketing question nobody is asking

The model was supposedly leaked unofficially and then found by others. I find that hard to believe. Months before this announcement, someone senior at my organisation sat down with Anthropic's Australian sales team and was given the same narrative about model power and security capabilities. A colleague went to a Cursor conference and heard a similar pitch. The sales teams in regional offices do not build models. They are given talking points from headquarters. When those talking points match a "surprise" announcement months later, that is not a coincidence. That is a rollout.

I am not saying the model is fake. I am saying the story around it is engineered. I work in a large organisation. I see how strategic communications works. The product is real. The narrative is manufactured. Those two things coexist all the time. Every enterprise tech company does this. You build something genuinely impressive, then you construct the most dramatic possible framing for the announcement. The zero-days are real. The theatrics of restricting access to create scarcity and urgency - that is marketing.

None of this means Glasswing is not important. It means I am reading it with the same skepticism I would apply to any vendor announcement. The capability speaks for itself. The story around it does not need my help.

I am upgrading anyway

Here is the part that makes me a hypocrite. I see through the marketing playbook and I am still going to be first in line for Mythos the moment it is available. Of course I am. I run my entire operating system on Claude. Five agents, a model router, overnight automation, a management cadence where AI agents brief each other daily. Claude is not a tool I use occasionally. It is the foundation everything else is built on.

When Opus dropped, I did not use it to make slightly better chatbot responses. I built an operating system where agents route work across eight models, hold daily leadership meetings at 4:30am, and execute decisions autonomously while I sleep. That is a category change, not a speed improvement. Every model leap opens up things that were not possible before. That is exponential, not incremental.

The real question is whether most people will use Mythos that way. I have seen what happens when powerful tools meet unambitious use cases. We gave everyone in the organisation Cursor licenses. Everyone got excited. And all they did was make the Christmas lights a little brighter. Nobody changed the game. They used a more powerful tool to do the same thing slightly faster. That is the pattern with every model upgrade. Most people take a capability leap and use it for an efficiency gain.

A more powerful model should not mean doing what you currently do more effectively. It should push the boundaries of what you can do at all. Finding zero-days that humans missed for 17 years - that is a boundary push. Using Mythos to write marginally better emails is Christmas lights.

The cost nobody mentions

I currently run two Claude supermax subscriptions and a Codex Max subscription to keep my system operational. That is real money for someone generating zero revenue. I do it because the capability justifies the cost - for now. But every model announcement raises the same question that nobody in these launch threads wants to talk about.

How much is Mythos going to burn?

Same subscription limits but a more expensive model underneath - does that mean fewer messages per day? Does my router need to get even more aggressive about sending simple tasks to cheaper models? Token economics are the unglamorous reality behind every capability announcement. The model can find thousands of zero-days. Impressive. What does it cost per hour of autonomous operation? That number determines who can actually use it and who just reads about it.

Anthropic has not solved for token usage. They have solved for capability. Those are different problems and they compound in opposite directions. More capability means more demand. More demand against the same subscription ceiling means more rationing. The people who will get the most out of Mythos are the ones who already built systems to manage token allocation - routing, caching, tiered autonomy. Everyone else will hit the ceiling faster and blame the subscription model.

The boring takeaway

I am skeptical about the announcement. I am excited about the model. I am worried about the cost. All three at once. That is the honest position of someone who depends on this technology every day and has seen enough vendor launches to know the difference between capability and narrative.

The model is real. The zero-days are real. The strategic positioning of frontier labs as security infrastructure - that is real too, and it matters more than most builders are thinking about right now. But the breathless framing of "too dangerous to release" is a choice, not a fact. It is the most dramatic version of a real story, told by people who have a commercial interest in you being impressed.

Be impressed by the capability. Be skeptical of the story. And when Mythos drops for general access, use it to change the game, not to make the Christmas lights brighter.