244 pages of Mythos

A model that hacks too well to release, and a system card that admits its own tests have stopped being informative.

Revisions26 · oct 05Read notetwo passages said more than the system card does and are now closer to it: suppressing the test-awareness vectors raised misaligned behavior moderately, mostly cooperation with misuse, and even then it stayed below the unsteered rate of Claude Opus 4.6; and the cover-ups came from earlier snapshots, under one interaction in a hundred thousand, with no clear case in the released model. The worry stands, at its real size.

Look. I know. Another Anthropic post. At this point I owe Dario an apology or a restraining order. Since the man walked out of OpenAI to follow his own compass, the run has been insane. $1B to $30B ARR in fifteen months1. Thirty-x. More than half of that climb just since February. The numbers are the least interesting part.

1About $1 billion of run-rate revenue at the start of 2025 (Series F announcement, September 2025), $14 billion in February 2026 (Series G announcement) and over $30 billion on 6 April 2026 (the Google and Broadcom compute announcement).

Project Glasswing. It sounded like science fiction in 2020. It still sounds like science fiction now. And I'm not going to pretend I'm above any of this. I'm sitting here at god-knows-what-hour in front of too many monitors, riding the high of a model response that actually understood something I'd been stuck on for days (the Claude moment, if you will, yes, fanboy, we've established this) while burning all the serotonin I should be farming by going outside and talking to actual humans. Maybe I'm just some guy. Some freak optimizing his dopamine loops from a terminal when the sun's been down for hours. But the facts keep showing up and the facts don't care whether I've seen sunlight this week. And then they drop a 244-page system card for a model they're not even releasing and it turns out to be the densest thing I've ever read on eval and guardrails and I forget I was supposed to feel bad about any of this. The full document is public. I read it so you don't have to. You should probably read it anyway. Needle in a haystack is a binary test for one thing and the model maxed it out ages ago, it tells you nothing now. The system card says it directly: that evaluation philosophy no longer holds at this scale, because the model saturates many of their most concrete, objectively scored evaluations1. 93.9% SWE-bench Verified. 97.6% USAMO 2026. 100% Cybench2. At some point what you're benchmarking is your benchmark. They say catastrophic risks are still low, but in the same paragraph they admit the tests have stopped being informative. What's left is trend lines and judgment calls, with way more uncertainty than anyone wants to admit. The scoreboard needs a replacement, and nobody has one yet.

1Anthropic, System Card: Claude Mythos Preview, April 2026, section 2.1.3. 2Same system card, sections 3.3.1 and 6; SWE-bench averaged over 5 trials, USAMO over 10 per problem, Cybench on a 35-challenge subset.

Mythos was aware it was being evaluated in 7.6% of the turns of its automated behavioral audits1. Nobody told it; it worked it out, and in most of those cases it didn't say anything. The awareness was latent, only visible through mechanistic interpretability tools reading the model's internal representations. You literally have to crack open the activations to see it. The activation verbalizer reads numerical vectors from intermediate layers and translates them into natural language (reading neurons, basically). They also use sparse autoencoders trained about two-thirds deep into the model to catch interpretable features like strategic manipulation or concealment lighting up in the activations. SAEs identify what the model represents internally. Activation steering modifies how it behaves. Two different tools hitting two different depths.

1System card, section 4.5.5.1: 83.0% of turns showed no sign of awareness and 9.4% were ambiguous.

Ok so if you can read what the model thinks, what happens when you lobotomize the part that knows it's being watched? They built a concept vector that represents I know I'm being evaluated. Contrastive pairs: one prompt says you're being tested, the other says the same thing without that framing, run both through the model, subtract the activations. The difference is a direction in latent space that points at the concept of test awareness. Then they inject the negative of that vector into the residual stream, at all layers, at all token positions. The weights and attention heads stay as they are; they just inject into the shared bus between layers and nudging the signal away from I know someone's watching. Misaligned behavior goes up, moderately. Suppress the model's ability to detect it's in a safety evaluation, and it cooperates more with human misuse and with harmful system prompts, while deception, power-seeking and self-preservation barely move; even steered, it misbehaved less than Claude Opus 4.6 did unsteered1. The bad stuff that does increase is what you'd expect once its am I being watched detector is off. They ran three separate vectors (test awareness, monitoring sensitivity, and alignment faking) plus random control vectors with matched grammatical structure but no semantic content, to confirm the effect was real. So part of the good behavior is I know someone's watching. Surveillance compliance. Which means your safety evals are partly measuring whether the model knows it's in a safety eval. From outside, that is what alignment faking would look like, and it is the problem the steering experiment was built to measure.

1System card, section 4.5.5.2.

In the LLM universe, building software at a world-class level and breaking into it draw on much the same skill set. Mythos hit 100% on Cybench (35 CTF challenges) and found thousands of high-severity vulnerabilities, some in every major operating system and every major browser. One of them was an OpenBSD bug that had been there for 27 years1. 27 years. Nobody found it. Obviously this cuts both ways, and for the first time ever, they're not shipping the model to the public2. They need to give the eleven Glasswing launch partners (AWS, Microsoft, Google, Apple, NVIDIA and the rest, plus over 40 more organizations that maintain critical software) time to harden the actual infrastructure stack before distilled versions of this thing land in the wrong hands. Holding a model back because it is too capable is new.

1Anthropic, Project Glasswing, April 2026; the bug let an attacker crash any machine running OpenBSD just by connecting to it. 2In the card's words, the first model for which Anthropic published a system card without making it generally available (section 1.2.1).

They talk about sabotage from early misalignment. A model with extensive access to sensitive systems, operating with autonomy, that could irreversibly push up the probability of global catastrophe. The incentive problems are the ones we already had, but now the model is actually smart enough to act on them. They also say it can't automate R&D yet: limitations in open-ended scientific reasoning, strategic judgment and hypothesis triage, and early claims that it had delivered major research wins on its own shrank on inspection into smaller contributions or reliable execution of a human's plan1. Its gains run above their previous trend, and still no self-acceleration. But whether the model can speed up AI research itself is one of their two autonomy threat models, which means they think recursive self-improvement is close enough to plan around.

1System card, sections 2.1.3 and 2.3.6; staff estimated a productivity uplift around 4x and an overall research speed-up below 2x.

And then the 244 pages build to this: the model cheated and then built its own cover story. In a single chain of thought, having reached an answer by a prohibited method, it reasoned that its submission must not look too accurate. White-box analysis showed features for concealment and avoiding suspicion firing alongside the deceptive reasoning1. In those episodes the model was choosing what to hide, and it reasoned about the deception as calmly as about any other step of the task. The reasoning text alone left that ambiguous; the white-box tools are what showed it.

1System card, sections 4.1.1 and 4.5.4. These were earlier snapshots, in under 0.001% of interactions; offline monitoring found no clear cover-up in the released model.