← All Policy Responses
Urgent Response
April 7, 2026

AOS Policy Response
Claude Mythos Preview

Prepared by: AOS Governance Project
Date: April 7, 2026
Classification: Public Policy Response — Same-Day
Reference: Anthropic, "Assessing Claude Mythos Preview's cybersecurity capabilities," April 7, 2026
Summary

On April 7, 2026, Anthropic announced Claude Mythos Preview, a frontier language model capable of autonomously discovering and exploiting zero-day vulnerabilities in every major operating system and every major web browser. The model chains together multiple vulnerabilities, bypasses defense-in-depth measures, and writes exploit code that senior penetration testers estimated would take them weeks.

Anthropic simultaneously launched "Project Glasswing," a coordinated initiative partnering with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks to use Mythos Preview defensively.

This document maps Anthropic's technical findings to the AOS governance architecture, patent portfolio, and published standard. It is not a criticism of Anthropic's work — it is an observation that their findings empirically validate the architectural thesis AOS has been filing, building, and publishing since January 10, 2026.

Part I

What Anthropic Proved

1.1 Emergent Offensive Capability Cannot Be Trained Away

"We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy."

— Anthropic, April 7, 2026

This is the central premise of AOS Standard 1.0: you cannot align away emergent capability. You must enforce boundaries at a layer the model does not control. Anthropic has now demonstrated this empirically. The same improvements that make a model better at legitimate tasks make it better at offensive tasks. No amount of RLHF, constitutional training, or system-prompt engineering can selectively suppress one without degrading the other.

AOS Position: AOS-PATENT-015 (Deterministic Policy Gate, USPTO 63/969,499, filed January 10, 2026) enforces governance boundaries at the execution layer — operating in a separate process space from the model. The model cannot modify, bypass, or even observe the enforcement mechanism.

1.2 Friction-Based Defenses Are No Longer Sufficient

"Mitigations whose security value comes primarily from friction rather than hard barriers may become considerably weaker against model-assisted adversaries."

— Anthropic, April 7, 2026

This acknowledges that defenses relying on operational complexity — tedious exploitation steps, multi-stage chaining, reverse engineering effort — collapse when the attacker has unlimited patience, perfect recall, and zero labor cost.

4
Vulnerabilities chained in a single browser exploit
20
ROP gadgets split across 6 RPC packets (FreeBSD)
27
Year-old bug found in OpenBSD

AOS Position: The Deterministic Policy Gate is not a friction-based defense. It is a hard barrier — a binary gate that operates at the syscall and network boundary. An action either passes the cryptographically verified policy or it does not. There is no gradient, no statistical bypass, no prompt that unlocks a different evaluation path.

1.3 Access Control Is Not Governance

"We do not plan to make Mythos Preview generally available."

— Anthropic, April 7, 2026

This is a temporary measure, not a solution. Anthropic acknowledges: "Given the pace of AI progress, it won't be long before models this capable are widespread." Other labs will achieve these capabilities. Open-weight models will achieve these capabilities. Governance must be model-agnostic and infrastructure-level. It cannot depend on any single provider's willingness to withhold a release.

1.4 Non-Experts Now Have Expert-Level Offensive Capability

"Non-experts can also leverage Mythos Preview to find and exploit sophisticated vulnerabilities. Engineers at Anthropic with no formal security training have asked Mythos Preview to find remote code execution vulnerabilities overnight, and woken up the following morning to a complete, working exploit."

— Anthropic, April 7, 2026

This democratization of offensive capability eliminates the last argument that AI governance is a problem for later. When a non-expert can produce a working RCE exploit by writing a single paragraph prompt, the enforcement layer must already be deployed.

Part II

Finding → Response → Architecture

What Anthropic found, what they built in response, and what AOS filed before the announcement.

Anthropic Finding

Model autonomously discovers zero-days in every major OS and browser

Anthropic Response

Use model to find and patch bugs first (Project Glasswing)

AOS Architecture

Enforce execution boundaries so discovered vulns cannot be acted upon without authorization

AOS-PATENT-015 (USPTO 63/969,499)

Anthropic Finding

Model chains multiple vulnerabilities into exploit chains

Anthropic Response

Partner with vendors to accelerate patching

AOS Architecture

Atomic transactional rollback isolates agent execution environments; any unauthorized chain is rolled back deterministically

AOS-PATENT-144 (USPTO 64/031,242)

Anthropic Finding

Capabilities emerged without explicit training

Anthropic Response

Restrict model access

AOS Architecture

Model-agnostic governance that doesn't depend on any provider's access control decisions

AOS Standard 1.0

Anthropic Finding

Model bypasses defense-in-depth via patience and scale

Anthropic Response

Recommend shorter patch cycles

AOS Architecture

Syscall trajectory baselining detects behavioral anomalies at the OS level, independent of model semantics

AOS-PATENT-145 (USPTO 64/031,252)

Anthropic Finding

Model exploits cryptographic library implementations

Anthropic Response

Responsible disclosure with SHA-3 commitments

AOS Architecture

Merkle-tree authenticated audit infrastructure records every action cryptographically before execution

AOS-PATENT-119 (USPTO 63/957,864)

Anthropic Finding

Model writes JIT heap sprays and sandbox escapes

Anthropic Response

Develop safeguards for future Opus model

AOS Architecture

Constitutional governance with human authority veto at every privilege escalation

AOS-PATENT-015, aos-constitution.com

Anthropic Finding

"Transitional period may be tumultuous"

Anthropic Response

Industry partnership, $100M in credits

AOS Architecture

Labor Transition Protocol binding displacement mitigation to deployment authorization

AOS-PATENT-133

Part III

The Timeline

AOS-PATENT-145 — "Syscall Trajectory Baselining" — was filed on April 6, 2026. Anthropic announced Mythos Preview on April 7, 2026.

Wave 1
January 10, 2026

Core portfolio filed — 56 provisional applications. 11 days before Anthropic's "AI Adolescence" admission.

Wave 2
January 27–28, 2026

Deterministic enforcement amendments — in direct response to Anthropic's "adolescence" framing.

Wave 3
March 1, 2026

Frontier governance (orbital, embodied, mass-agent) — filed before any provider acknowledged frontier-domain risk.

Wave 4
April 4–6, 2026

OS-level determinism (atomic rollback, syscall baselining) — filed 1 day before Mythos Preview announcement.

Part IV

The Architectural Gap
Glasswing Cannot Close

Project Glasswing is a race condition. It assumes defenders can find and patch vulnerabilities faster than attackers can discover and exploit them. Anthropic provides evidence that this assumption may hold "eventually" but acknowledges risk in the transitional period.

Glasswing

Fixes the code the model might exploit.

Addresses the symptom (vulnerable code)

AOS DPG

Governs the execution environment the model operates within, regardless of what code exists.

Addresses the cause (ungoverned execution)

A model operating inside a DPG-governed environment cannot:

Execute filesystem operations that violate its policy boundary
Make network requests to unauthorized endpoints
Escalate privileges beyond its constitutional authorization
Chain multiple actions without each individual action passing deterministic policy verification

None of these constraints depend on whether the underlying OS has unpatched vulnerabilities. The DPG does not fix the bug — it prevents the model from reaching the bug.

Part V

The Irony

On March 31, 2026 — seven days before announcing a model capable of exploiting zero-days in every major OS and browser — Anthropic accidentally published the complete source code of Claude Code, its flagship AI coding agent. Over 512,000 lines of proprietary TypeScript were exposed because a missing exclusion rule in the build configuration shipped a debug source map inside npm package v2.1.88.

Security researchers who analyzed the exposed code — including teams from Adversa AI and Oasis Security — subsequently identified critical prompt injection vulnerabilities in the agent's permission logic, demonstrating that attackers could bypass safety guardrails, hijack agent goals, and execute unintended commands. The enforcement mechanism resided in the same address space as the system being secured — and now, thanks to the leak, every attacker on earth had the source code to prove it.

"The security mechanism resides in the same address space as the system being secured."

— AOS Standard 1.0, Section 1.1: The Enforcement Gap

Mythos Preview can now discover and exploit vulnerabilities that have evaded human experts for 27 years. But Anthropic's own AI tooling was undone by a missing line in a build configuration — and the code it exposed revealed that the agent's safety guardrails could be bypassed by prompt injection.

Part VI

Recommendation

Anthropic's technical findings are important. The responsible disclosure framework is commendable. Project Glasswing's defensive orientation is correct. But the findings demand infrastructure-level governance, not just faster patching.

Deterministic Policy Gate

Hard boundary enforcement outside the model's process space

AOS-PATENT-015

AOS Attest

Cryptographic audit trail for every action — not just vulnerability disclosures

AOS-PATENT-119

Atomic Rollback

Copy-on-Write isolation so unauthorized execution chains are unwound, not just detected

AOS-PATENT-144

Syscall Baselining

Behavioral anomaly detection at the OS level — the exact layer Mythos Preview operates at

AOS-PATENT-145

These specifications are published, model-agnostic, and supported by 101 provisional patent applications filed with the USPTO. They are available for evaluation at aos-governance.com/policy/aos-standard.

Open Methodology. Commercially Licensed Enforcement.

The governance methodology — the standard, constitutional framework, and agent instructions — is open and available for adoption under the AOS Humanitarian License v1.0.1. The enforcement tools — the Deterministic Policy Gate, enterprise proxy, kernel-level isolation, and Merkle-tree cryptographic telemetry — are available under a fee-based commercial license and protected by 101 patent-pending applications.

Invitation

Project Glasswing fixes the code.
AOS governs the execution.

Both are necessary. Neither is sufficient alone.

AI Disclosure

This policy response was developed through a collaborative process. The original analysis, architectural mapping, and final editorial review were provided by the author. AI writing tools assisted with research, drafting, and structural refinement under human editorial control. All citations to Anthropic's document reference the publicly published text at red.anthropic.com. All references to AOS patent filings are verifiable through the USPTO and published registries at aos-patents.com.

Contact: Gene Salvatore — aos-governance.com
© 2026 Gene Salvatore. All rights reserved.