The Invisible AI
How the most capable model ever built operates outside public reach — and why that's a policy choice, not a necessity.
---
On the morning of April 7, 2026, before Anthropic had finished drafting its press release, a user on Discord guessed the URL. They typed it into their browser and found themselves staring at a landing page for something called Claude Mythos Preview. The model existed. Its capabilities were real. But they couldn't access it, couldn't test it, couldn't verify anything about it. They posted a screenshot. Within hours, the thread was the most-read discussion in the AI community.
That's a fitting introduction to Mythos: the AI you can know about without being able to know anything of.
---
Seven weeks later, here's what the public record contains. Anthropic announced Project Glasswing on April 7 — a $100 million initiative to secure critical software infrastructure. Mythos is its engine. Access is restricted to approximately 50 organizations: Amazon AWS, Apple, Google, Microsoft, NVIDIA, JPMorgan Chase, Goldman Sachs, CrowdStrike, the Linux Foundation, and — notably — the NSA.
The capabilities, as documented by Anthropic itself and a British government evaluation, are precise enough to be alarming. Mythos found a 27-year-old vulnerability in OpenBSD and a 16-year-old flaw in FFmpeg — both undetected after five million automated test runs. In 83% of cases, it writes functional exploit code on the first attempt. It understands "vulnerability chaining": linking minor flaws into attack sequences that grant full machine control. It can analyze compiled binary code without access to source — meaning legacy systems, previously protected by obscurity, are no longer safe.
The British government's conclusion: Mythos is "substantially more capable at cyber offence" than anything previously evaluated.
Anthropic's argument for restricted access is coherent: if Mythos were widely available, malicious actors could use it to find the same vulnerabilities. By limiting access to organizations defending critical infrastructure, the company aims to create a defensive head start. The logic holds. The consequence doesn't disappear: the most capable AI ever built operates outside public reach — and outside public accountability.
---
Then comes the paradox that makes this story more than a corporate announcement.
The Pentagon classified Anthropic as a "supply chain risk." Secretary Hegseth called Claude "woke AI." The company's models were removed from military computers. Anthropic had refused to make its systems available for mass surveillance or autonomous lethal weapons.
And yet: the NSA uses Mythos. Pentagon CTO Emil Michael acknowledged this to CNBC: "Mythos is a separate national security moment."
The statement is probably accurate. It also reveals the structural contradiction at the center of this story. The institutions responsible for regulating and overseeing AI use are also its users. The NSA evaluates Mythos and deploys it. The auditor is the operator. There is no obvious remedy for this inside the current framework — and no external party with the authority or the access to close the gap.
---
Mythos would be easier to address if it were anomalous. It isn't.
Palantir's Maven Smart System — which had operated with a $480 million budget in 2024 — was formally designated as an official Pentagon "program of record" in March 2026. The total investment grew to $13 billion. In April, reporting confirmed that the Pentagon used Claude and Maven jointly to identify 1,000 targets in strikes against Iran. The targeting AI is not available for external audit.
After Anthropic's announcement, OpenAI — whose CEO had called the restricted-access approach "fear-based marketing" — launched its own restricted cybersecurity model within weeks. xAI signed agreements making its models available "across classification levels," including classified environments. No public benchmarks exist for those versions. No external red-teams have evaluated them.
The Netherlands is building a sovereign military cloud with KPN and Thales, explicitly to reduce US tech dependence. Which AI models will run inside it, and under what oversight, remains unanswered.
What's emerging isn't a series of isolated decisions. It's a new infrastructure category: state-level AI. Not public. Not auditable. Built by commercial companies, deployed by governments, and structurally outside the regulations designed for exactly this kind of risk.
---
The EU AI Act is the most ambitious AI regulation in the world. Enforcement for high-risk systems begins in August 2026. Fines reach €35 million or 7% of global revenue.
Article 2(3) is unambiguous: the regulation does not apply to AI systems deployed exclusively for military, defense, or national security purposes.
That's not a footnote. That's a complete exemption for the highest-risk applications. And "national security" is a flexible definition. Research from TechPolicy.Press and Statewatch documents how EU member states are already stretching it: Serbia invoked it to withhold a welfare algorithm from review. Spain's social voucher system BOSCO kept its source code classified until the Supreme Court intervened in 2025. Hungary used facial recognition against protesters. France quietly extended counterterrorism surveillance to messaging applications.
AI safety researchers face a parallel problem. Without access to Mythos, they cannot build realistic risk models. Stanford HAI's 2026 AI Index notes that frontier model developers report on capability benchmarks — but responsible AI benchmarks "remain sparse." Mythos has never participated in a public benchmark. No MMLU score. No SWE-bench result. It exists outside the measurable domain entirely.
The consequence: policymakers regulate based on publicly available models that no longer represent the frontier. The benchmark system — already imperfect — measures the second tier. The reference disappears.
---
History offers a template for this failure mode.
After 1945, the United States created a "born secret" classification regime for nuclear knowledge. Information that had never been public couldn't be challenged, critiqued, or shared with allies. Scientific critics were silenced. Proliferation was not prevented. The classification protected power, not safety.
In 1975, biologists chose differently. The Asilomar conference voluntarily halted risky recombinant DNA experiments and created shared guidelines — in public, with input from non-specialists. It remains the reference model for self-regulation that worked. There has been no Asilomar for frontier AI.
The NSA submitted compromised cryptographic algorithms to NIST. Decades passed before the damage became clear. The institution that benefits most from a technology set its own safety standards — a conflict of interest with no internal resolution.
Researchers Aidinoff and Kaiser identify three governance failures that recur across these cases: self-regulation consistently falls short, expert-only oversight gets captured by sector interests, and static governance gets overtaken by technological development. Mythos, six weeks into its restricted existence, already demonstrates all three.
---
Tomorrow, this publication will cover the PII Firewall Pattern: users deliberately withholding personal data from cloud AI. They don't trust the model with their information. They build walls.
Now the direction reverses. It's the AI that withholds itself. Not the user builds the wall — the operator does.
Both patterns reflect the same underlying shift: AI has become powerful enough that everyone is shielding something. Users protect their privacy. Companies protect their capabilities. Governments protect their operations. The result is a segmented AI landscape — not one public AI, but multiple parallel ecologies, each with its own access rules and its own accountability void.
The question isn't whether Anthropic made the right call on Mythos. They may have. The question is who decides that, by what process, and who gets to say so afterward.
Right now: nobody does.
---
Sources
Reporting on Claude Mythos & Project Glasswing
- Anthropic testing powerful new AI model after data leak — Fortune — First reporting on the inadvertent reveal that exposed Mythos's existence before the official announcement.
- Anthropic Claude Mythos — Builtin — Overview of Mythos capabilities and the restricted-access programme.
- Project Glasswing announcement — Anthropic — Primary source: Anthropic's own framing of the $100M cybersecurity initiative.
- Unauthorized group gained access to Mythos — TechCrunch — Report on the access breach that confirmed Mythos's real-world deployment.
- Mythos accessed by unauthorized users — Bloomberg — Bloomberg's independent confirmation of the breach and reactions from Anthropic.
- NSA, Anthropic, Mythos, Pentagon — Axios — Documents the NSA's place on the access list while the Pentagon banned Anthropic.
- Pentagon, Anthropic blacklist, Mythos — CNBC — Interview with Pentagon CTO Emil Michael explicitly acknowledging NSA use of Mythos.
- What do we know about Anthropic's Mythos — BNN Bloomberg — Summary of public knowledge gaps and concerns about evaluation.
Military AI & the Broader Trend
- Pentagon formalizes Palantir's Maven AI — Tom's Hardware — Source for the $480M (2024) → $13B Maven Smart System investment trajectory.
- Claude AI and Palantir Maven to identify 1,000 targets in Iran strikes — The Defense News — Reporting that confirmed the joint deployment of Claude and Maven in combat targeting.
- Pentagon AI tech giants snubs — TechXplore — Context on the OpenAI and xAI follow-on contracts and classification-level access agreements.
- Dutch defense to build sovereign military cloud — NL Times — Reporting on the KPN/Thales sovereign cloud initiative referenced in the article.
Regulation & Accountability
- When national security becomes a shield for evading AI accountability — TechPolicy.Press — Documents how EU member states stretch the "national security" exemption (Serbia, Spain, Hungary, France examples).
- EU AI Act, Article 2(3): Scope and exemptions — Primary source: the article that exempts military, defense, and national security AI from the regulation.
- Security exemptions in the AI Act — Statewatch — Detailed analysis of how the security exemption was negotiated and how it functions in practice.
Research & Benchmarks
- 2026 AI Index Report — Responsible AI chapter — Stanford HAI — Source for the observation that responsible AI benchmarks "remain sparse" while capability benchmarks proliferate.
- Frontier models are failing one in three production attempts — VentureBeat — Context on auditability challenges of frontier models in production.
- AI Governance and History — Aidinoff & Kaiser, Issues.org — The framework identifying three governance failure modes (self-regulation, expert capture, static governance) used in the historical section.
- Strategic warning for AI risk — Anthropic Frontier Red Team — Primary source: Anthropic's own evaluation of Mythos's offensive cyber capabilities.
