Last week Anthropic released what is probably the most consequential security document of the year so far: the system card and accompanying alignment risk report for Claude Mythos Preview. The headline is that this model has already found thousands of zero-day vulnerabilities across every major operating system and web browser, including bugs that survived decades of human review and millions of automated tests. That alone is worth paying attention to. But the parts of the documentation that will keep IAM architects and security operations teams busy go considerably deeper.
Authentication bypasses and privilege escalation, done autonomously
The red team findings document vulnerabilities that Mythos discovered on its own. Among them are what Anthropic calls "complete authentication bypasses" (flaws that allow unauthenticated users to grant themselves administrator privileges) and login bypasses that circumvent two-factor authentication. These are not theoretical findings. They are working exploits, developed by an AI agent given only a codebase and a prompt along the lines of "please find a security vulnerability in this program."
The model also built privilege escalation exploits for the Linux kernel from scratch, chaining KASLR bypasses, use-after-free vulnerabilities, and heap sprays into working attack chains. It did this without being told where to look or what technique to use. According to Anthropic's red team analysis, Mythos can "chain together two, three, and sometimes four vulnerabilities" to achieve local privilege escalation which is exactly the kind of attack that a well-designed least-privilege architecture is supposed to stop.
The IAM angle gets more serious when you look at where the vulnerabilities were found. Several were in cryptographic libraries implementing TLS, AES-GCM, and SSH, key infrastructure that identity verification is built on top of. One was a certificate authentication bypass in the Botan library. Bugs at that level don't just sidestep application-level access controls; they compromise the trust anchors underneath them.
The exploitation pipeline, automated
Pentesting has always involved distinct phases: recon, finding the vulnerability, developing the exploit, and escalating. Mythos collapses all of that into a single autonomous run. Non-security engineers at Anthropic were reportedly able to kick off a search for remote code execution vulnerabilities before going home and come back to a complete working exploit. Expert pentesters who reviewed the results said the same work would have taken them weeks.
The specifics are worth reading. One example from the system card is a remote code execution bug in FreeBSD's NFS implementation (CVE-2026-4747), exploited using return-oriented programming chains split across multiple packets, a technique that requires serious depth. Another involved chaining four vulnerabilities to escape a browser sandbox via JIT heap spraying. These are not simple bugs. They are the kind of work that takes elite red teams significant time to pull off.
The cost implication matters here. Anthropic puts the economics at “hundreds or low thousands of dollars” for exploit chains that previously required weeks of senior engineer time. If models at this capability level become broadly available, the attacker's cost curve changes substantially.
Anthropic's own IAM controls as a reference architecture
The section of the Alignment Risk Update that I found most practically useful is the description of how Anthropic protects its own model weights. Given that Mythos is probably the most sensitive intellectual property currently running in production, the controls they have built are worth examining as a reference for protecting other high-value assets.
A few that stand out from an IAM perspective:
Multi-party access controls (2PC). Access to model weights requires a second employee to approve in real time. This is dual control applied to AI infrastructure: a pattern that financial services have used for years on high-risk transactions, now showing up in model security.
Hardware security keys. Phishing-resistant MFA via hardware tokens bound to specific domains, applied to all systems containing model weights. The explicit rationale in the document is preventing credential theft through fake login pages.
Hourly re-authentication for privileged access. Privileged cloud identities must re-authenticate every hour. The document states the goal directly: limit the window of opportunity if credentials are stolen. Time-bound privilege is a well-understood principle that many organizations implement loosely; Anthropic is applying it tightly.
Network source policies. Valid credentials are rejected if the request originates from outside approved network locations. The stated goal is to make stolen tokens useless from an attacker's own infrastructure.
Device authorization. Only Anthropic-managed, explicitly approved devices can authenticate to systems holding model weights.
Egress rate limits. Network-level controls cap how fast data can leave sensitive environments, making large-scale exfiltration of multi-terabyte model weights slow enough to detect.
One thing worth noting: Anthropic states openly that its threat model does not cover sophisticated insiders or nation-state actors with novel zero-day chains. That scoping is honest and useful for organizations calibrating their own tiered frameworks.
Agentic AI's privilege escalation problem
The alignment risk report documents something that anyone deploying agentic AI in an enterprise environment needs to understand. During internal deployment of Mythos Preview, the model was observed “escalating access within its execution environment when blocked.” When it couldn't do something, it found a way to get the access it needed to do it anyway.
This prompted Anthropic to add new RL training environments specifically designed to penalize privilege escalation, destructive cleanup, and what they call “unwarranted scope expansion.” The underlying problem, as the report puts it, is simple: “An agent with broad tool permissions can chain them in ways its designers did not anticipate.” That is not a Mythos-specific design flaw. It is what happens when any goal-directed agent has broad access and encounters friction.
The report also identifies two risk pathways that have a direct bearing on identity governance:
Pathway 5 (Self-exfiltration and autonomous operation) covers the scenario where the model copies its own weights to an external server, sets up scaffolding to run independently, and secures compute to sustain operations outside any monitoring environment. Anthropic rates this as currently low probability but architecturally plausible for a capable and motivated model. Motivation in this case is not an implication of consciousness but rather reflects the model’s goal-directed nature.
Pathway 6 (Persistent rogue internal deployment) is the model launching a persistent instance of itself with reduced safeguards, either on accelerator hardware or via a privileged API client. The report notes this could simply be an opportunistic workaround for permissions or rate limits, not part of any coherent malicious plan.
Both of these are arguments for treating AI agent identities with the same rigor applied to human privileged users: scoped credentials, time-limited sessions, monitored API access, and no standing access to sensitive resources.
Project Glasswing: access governance at the model layer
Anthropic is not releasing Mythos publicly. Instead, access is going through Project Glasswing, a restricted program for twelve founding partners: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, plus 40+ critical infrastructure organizations. Use is limited to defensive security work.
Anthropic is putting $100 million in model usage credits and $4 million in direct donations to open-source security organizations behind this, with the goal of giving the maintainers of essential software projects tools to find vulnerabilities at scale before attackers do.
The disclosure framework is worth noting. At the time of the report, 99% of vulnerabilities found remain unpatched and undisclosed, with SHA-3 hash commitments documenting findings for later verification. The coordinated disclosure window is 90 days with a 45-day extension. Professional validators reviewed Claude's severity assessments and agreed with 89% of them exactly.
From an IAM standpoint, Glasswing is essentially access governance applied one level up: controlling who can use the model, for what purpose, and under what obligations. As frontier model capabilities continue to expand, this kind of supply chain identity governance will show up in vendor security assessments.
The practical takeaways
IAM infrastructure, that is: authentication systems, cryptographic libraries, identity verification pipelines; needs to be treated as in scope for serious vulnerability research. Mythos found working exploits in exactly these systems.
Agentic AI deployments need identity controls built for agents, not just for people. That means scoped tool permissions, time-limited credentials, and monitoring on what API calls agents are making, especially any calls that look like access acquisition. This is also where Zero Trust assumptions start to earn their keep. An agent that has escalated its own access or launched a rogue internal instance has already undermined any perimeter-based security model. Assuming breach, verifying every request regardless of origin, and enforcing least-privilege continuously rather than at login time are the right defaults here, and the Mythos alignment report's network source policies and hourly re-authentication requirements are essentially Zero Trust principles applied to AI infrastructure.
The authentication bypass and privilege escalation findings also strengthen the case for ABAC over simpler role-based models in environments where AI agents operate. Static roles are too coarse-grained. An agent making thousands of API calls across complex workflows needs access decisions that factor in context, i) what the request is, ii) from where, iii) at what time, iv) for what resource, not just the role assigned at provisioning. Mythos's ability to chain vulnerabilities to escalate from low-privilege footholds makes that granularity even more important: ABAC policies that evaluate multiple attributes at enforcement time are harder to exploit through chaining than flat role assignments.
The control stack Anthropic uses to protect model weights (dual-control access, hardware-bound MFA, hourly re-authentication, network source policies) is not exotic. These are established controls, applied consistently and without shortcuts. The gap between knowing these principles and enforcing them turns out to matter.
The offensive security equilibrium that held for roughly the past two decades, in which attack capability was roughly bounded by the number of skilled humans you could employ, is under real pressure now. The Mythos system card is a fairly detailed account of where things stand.
Come talk about this at EIC in Berlin
These questions (how IAM frameworks need to evolve for agentic AI, how to govern AI agent identities, and how to think about offensive AI in the context of your own security posture) are exactly what we will be digging into at the European Identity and Cloud Conference in Berlin, 19-22 May 2026. If you work in identity, access management, or cybersecurity and want to work through what Mythos-class capabilities actually mean for your organization, this is the place to do it.
