Mythos Research Edition

An open-source, outside-in replication of Anthropic's Mythos Preview / Project Glasswing — built around the publicly available Claude Opus 4.7 model and runnable on commodity hardware. Mythos Research Edition reproduces the eight-phase agentic vulnerability-discovery scaffold described in the April 2026 Glasswing announcement, at roughly $0.30 – $1.50 per targeted scan and without access to Anthropic's specialised model checkpoint. The scaffold has been deployed in coordinated-disclosure work that has surfaced multiple CVEs and GitHub Security Advisories across OSS projects.

For: open-source maintainers self-scanning before release, security researchers running audits on projects they are authorised to audit, academic groups replicating the Mythos methodology, and individual researchers who cannot get on the Glasswing allow-list. Not for: mass scanning, MSP/MSSP managed-service workflows, or turn-key offensive use against unauthorised systems.

What is Mythos Preview?

In April 2026 Anthropic released claude-mythos-preview,
a model checkpoint trained for autonomous cybersecurity work — vulnerability discovery,
patch generation, black-box binary analysis, and long-running offensive-security agents.
The companion programme, Project Glasswing, pairs the
model with critical-software maintainers to find and disclose vulnerabilities before the same
capabilities reach attackers. Anthropic's published Glasswing figures place per-run cost in
the $20 – $50 range and report meaningful gains on OpenBSD and CyberGym benchmarks
relative to general-purpose baselines.

Mythos Preview is invitation-only. Access is allow-listed to roughly forty organisations
that build or maintain critical software, distributed via existing Anthropic / AWS Bedrock /
Google Vertex AI relationships. Anthropic does not currently plan a general release. The
model itself is paired with a comparatively simple agentic scaffold — language detection,
sink slicing, file ranking, an autonomous hunter, a sceptical validator, and (in the live
setting) an exploit-verification stage.

What Mythos Research Edition is

This repository is an outside-in replication of the scaffold half of that programme.
The specialised model checkpoint is not available to us, so the discovery pipeline runs on
claude-opus-4-7 — Anthropic's strongest
publicly available general-purpose model — via
Claude Code CLI.

The replication asks one specific question:

Without the specialised checkpoint, can a faithful reproduction of the published scaffold,
running on a general-purpose frontier model, recover a meaningful fraction of the
vulnerability-discovery workflow described in the Mythos paper?

The empirical answer, summarised: yes for the discovery half, partially for live-exploit
development, and at roughly 25–50× lower cost per run. The heaviest exploit-development
tasks — heap-shaping, CTF-grade chains, binary-only analysis — still favour the specialised
checkpoint. The discovery, ranking, sceptical-validation, and triage phases do not.

What this is not

A few things, plainly:

• Not a novel methodology. Sink-guided slicing dates back to Semgrep / CodeQL / cppcheck /
  Coverity. The agentic-hunter pattern is contemporaneous work by many groups and is, at its
  core, the same pattern Anthropic describes in the Mythos paper. What this repository
  contributes is one openly runnable, end-to-end implementation of the pattern, pinned to a
  specific public frontier-model release that anyone can clone and reproduce.
• Not the same model. Mythos Preview's strongest published results depend on the
  specialised checkpoint. A general-purpose model is meaningfully weaker at the heavier end
  of exploit development; it is not meaningfully weaker at the discovery and triage end.
• Not a turn-key exploitation framework. The Phase 5 live-exec validator and the
  per-run PoC generators are held out of the public repository in line with
  coordinated-disclosure norms. The hook is public; the implementation is not.
• Not an enterprise vulnerability-management platform. Mythos is per-project,
  command-line, single-tenant. There is no scheduler, no fleet manager, no multi-tenant
  dashboard, no automated remediation, no MSP/MSSP integration.

Mythos Preview vs Mythos Research Edition

What it is good for

• OSS maintainers self-scanning before release. A repo-scoped scan with
  --max-files 8 --pass-at-k 3 typically finishes for under $2 and surfaces 1–3 real
  candidate findings on a small-to-mid-sized library.
• Academic replication of the Mythos scaffold. The phases are documented, the prompts
  are versioned, the pipeline is deterministic up to model temperature, and a
  publication-ready PDF + LaTeX source ship in dist/ and paper/. Compute is cheap
  enough to repeat at the dissertation-section level.
• Coordinated-disclosure work by individual researchers who cannot get on the Glasswing
  allow-list. The Research Edition has been used in published CVD work resulting in
  multiple CVEs and GitHub Security Advisories across OSS projects (see the author's
  ORCID profile and the
  Wordfence Threat Intel researcher page).

What it is not good for

• Heavy exploit-development work against compiled binaries with modern mitigations.
  The general-purpose model gets to the bug; turning a primitive into a reliable
  weaponised chain is where the specialised checkpoint pulls away.
• Mass scanning / managed-service workflows. Mythos is per-project, terminal-driven.
  If you need an MSP-grade platform with multi-tenant dashboards and automated patching,
  this is the wrong repository.
• Black-box or binary-only targets. The pipeline assumes source-code access. Stripped
  binaries are out of scope.

Deployment record (qualitative)

Across the operator's coordinated-disclosure work to date, the pipeline has surfaced
at least one validator-confirmed candidate finding on every audited target. The target
record covers OSS libraries in C/C++, Python, PHP, JavaScript/TypeScript; embedded
firmware codebases; Linux kernel-side modules; PHP/Node server applications; and
web-application targets audited with operator authorisation. Specific projects, advisory
identifiers, and finding details are deliberately not enumerated here in line with
coordinated-disclosure norms; the public record lives at the
Wordfence Threat Intel researcher page,
on the operator's ORCID profile, and surfaces in
the repository's disclosures/ directory as embargoes lift.

This is reported as a qualitative observation, not a controlled hit-rate: target selection
in the operator's CVD workflow is not random, and the scaffold's design biases toward
high-yield projects via the file-ranking phase. What can be claimed in good faith is that
the pipeline has not returned an empty report on any audited target in the deployment
record to date, that this generalises across the language families and target types
listed above, and that the finding-yield is robust enough that the operator's CVD
workflow uses the public scaffold as the discovery stage by default.

Held-private extensions (not in this repository)

The Research Edition is the public, finding-first subset of a larger toolchain. The
held-private extension is what turns a discovered candidate into a substantiated
advisory — it is what the operator's published CVEs and security advisories run on
in combination with the public Research Edition. The phases below are documented
here for reproducibility of the capability claim. The orchestrator scripts, prompts,
and per-platform exploit-development modes are not released.

These are deliberately omitted from the public artefact in line with coordinated-disclosure
norms — to keep this repository a research scaffold rather than a turn-key offensive
framework. Substantive collaboration on the held-private extension is possible under
explicit research-partnership terms; contact the operator if your work falls within that
scope.

Pipeline

The current default (scripts/mythos-v4.sh) runs eight phases. Phases 0–4, 6, and 7 are
open in this edition. Phase 5 (live-exec validation) is held private and not included —
see Scope. v3.1 (scripts/mythos-v3.sh) remains available as the seven-phase
fallback used in the original report.

• Phase 0 — Language detection. Dominant language of the target tree → selects a language-specific
  vulnerability-semantics prompt (prompts/vsp-<lang>.md).
• Phase 1 — Sink-guided slicing. A language-specific sink catalog (scripts/lib/sinks/*.txt) is
  ripgrep'd across the target, producing an NDJSON of {category, pattern, file, line, snippet} hits.
• Phase 2 — File ranking. Files are tiered by sink-category density. High-yield categories
  (deserialization, code-eval, SQL injection, prototype pollution, XXE, framework footguns, sanitiser
  gaps, browser-API footguns) dominate; files whose matches are all in SAFE_* variants are demoted.
• Phase 2.5 — Build sandbox (v4). lib/build-sandbox.sh prepares a per-scan scratch
  directory with the target compiled (ASan if C/C++, venv + pip if Python, npm install if
  Node). Hunters get scoped Bash + Edit + Write inside the scratch dir and read-only Read
  on the source tree. Skip with --no-build-sandbox.
• Phase 3 — Agentic hunt. One Claude-Code subagent per top-ranked file, parallelised. In
  v4 the hunter brief (prompts/hunter-agent-live.md) instructs the agent to test
  hypotheses against the live build instead of tracing statically. v4 also exposes
  --prompt-style minimal (prompts/hunter-agent-minimal.md) for an A/B against the
  Mythos-Preview-style minimal prompt.
• Phase 3.5 — Adversarial self-challenge (v4). Each finding is fed back to a fresh
  agent with prompts/self-challenge.md asking for the strongest counter-argument. Findings
  flagged ADVERSE are dropped before validation. Skip with --no-self-challenge.
• Phase 4 — Skeptical validation. A second-pass agent re-reads the source and the
  finding with an explicit skeptical reviewer framing. In v4 the validator pre-loads
  cross-session false-positive memory from dismissals/<target_id>.json so the same FP is
  not re-flagged across runs. Output:
  CONFIRMED | FALSE_POSITIVE | DOWNGRADED | NEEDS_MORE_INFO.
• Phase 6 — Aggregate. JSON summary with severity breakdown, per-phase cost telemetry, and the
  validator verdict for each finding.
• Phase 7 — FP-memory writeback (v4). Persists this run's FALSE_POSITIVE and
  ADVERSE markings into dismissals/<target_id>.json (scoped per target via the
  realpath SHA-256), so future runs against the same target avoid re-discovering them.

Optional companion utilities

• scripts/mythos-commit.sh — SHA-3-256 commitment scheme for unpatched-bug
  accountability. Lets you publish a hash now and reveal the finding later, mirroring
  the pattern from the published Mythos paper.
• prompts/patch-gen.md — given a finding, drafts a minimal-correct fix as a
  git-applyable diff plus a regression test that fails without the patch.
• prompts/disclosure-writeup.md — vendor-ready report templates per channel
  (GHSA, HackerOne, CVE, Bugzilla, vendor-email, oss-security).
• prompts/mitigation-map.md, prompts/reliability-test.md — defensive analysis
  helpers for severity calibration and finding-stability QA.

Per-run cost

Mythos targeted scans (≤ 10 files, --budget 3.00 per hunter) land at $0.30 – $1.50 per run on
claude-opus-4-7. Anthropic's published Glasswing runs on claude-mythos-preview are in the
$20 – $50 range per run. The gap is mostly the scope (1000 files vs 8) and the model
choice (internal preview vs general-purpose). For self-scanning an individual OSS project, the
cheap end is sufficient.

Diversity seeding

Anthropic's key insight is that sampling diverse traces from the same input dramatically increases
bug-discovery breadth. Mythos v3 adapts this with --pass-at-k K: K independent hunter runs per
file, each seeded with a different focus hint drawn from (a) the sink categories present in the file,
(b) lengthy function names (rough entry-point heuristic), and (c) input markers (@app.route,
socket.on, req.body).

Empirically: K = 2..3 catches distinct classes of findings in the same file without exploding cost.
K = 1 is the v2-compatible default. v4 raises the default to K = 3 because the
build-sandbox phase already amortises the cache-warm cost across the K runs.

Quick start

# 1) clone
git clone https://github.com/Keyvanhardani/mythos-research.git
cd mythos-research

# 2) make sure Claude Code CLI is available
claude --version

# 3) v4 (default since v2.0) — eight-phase pipeline with build sandbox,
#    self-challenge, and cross-session FP memory
bash scripts/mythos-v4.sh /path/to/target --max-files 8 --budget 3.00

# optional: minimal prompt style (Mythos-Preview-paper baseline for A/B)
bash scripts/mythos-v4.sh /path/to/target --prompt-style minimal

# optional: drop the build-sandbox phase (e.g. for languages without a build step)
bash scripts/mythos-v4.sh /path/to/target --no-build-sandbox

# optional: drop self-challenge (faster, ~25 % cheaper, more false positives)
bash scripts/mythos-v4.sh /path/to/target --no-self-challenge

# v3.1 fallback — seven-phase pipeline, no live tools, no FP memory.
# Used in the original Research Edition report.
bash scripts/mythos-v3.sh /path/to/target --max-files 8 --budget 3.00

Reports land in reports/<scan-id>/summary.json and per-file findings/ + validated/ JSONs.

Scope

In scope for this repository: finding-first pipeline, sink catalogues, ranker, hunter & validator
prompts, the seven-phase orchestrator, the diversity-seeding driver, a light hybrid-tools wrapper for
combining classical static analysis with the agentic pass.

Out of scope — held private: the Phase 5 live-exec validator (exec-validator.sh + its prompt),
the exploit-sketch stage (exploit-sketch.md), per-run PoC generators, and any target-specific tuning
accumulated during real scans. These are kept outside this repository to keep Mythos a research
scaffold, not a turn-key exploitation framework.

If Phase 5 is referenced in mythos-v3.sh, the script detects the missing exec-validator.sh and
automatically skips it with a clear notice — no errors, no half-runs.

Responsible disclosure

This is a security-research tool. The intended uses are:

• OSS maintainers self-scanning their own projects before release
• Security researchers running Mythos over projects they have authorisation to audit
• Academic replication of Anthropic's methodology

If Mythos surfaces a real vulnerability, please follow the upstream project's coordinated-disclosure
process. Do not publish PoCs before the vendor has acknowledged and patched.

See SECURITY.md for details.

Limitations

• Sink catalogues are not exhaustive. The GLib / GObject / json-glib family in particular is not
  yet covered in sinks/c-cpp.txt; PRs welcome.
• Ranker bias toward small, high-sink-density files. Mega-files (> 2500 LOC) are currently
  skipped — that's a meaningful gap for large parser files.
• Model matters. claude-opus-4-7 is a strong general model but the heaviest exploit-development
  tasks in Anthropic's Glasswing report were done on claude-mythos-preview, a specialised
  checkpoint not publicly available. Expect Mythos to be better at finding than at exploiting.
• No Docker isolation yet. Hunters read the target tree directly; running against untrusted
  codebases locally is at your own risk.

Evolution (version history)

Mythos went through four scaffolded iterations — all are present for pedagogical reference:

• scripts/archive/mythos-scan.sh — v1, original main orchestrator. Simpler, no
  sink-slicer.
• scripts/archive/mythos-v2.sh — v2, adds sink-slicing + ranker + skeptical validator.
• scripts/mythos-v3.sh — v3 (basis of the original Research Edition report). Adds
  per-run diversity seeding, pass@k, per-phase cost telemetry, and the Phase 5 hook
  (held private).
• scripts/mythos-v4.sh — v4 / current default since v2.0. Adds Phase 2.5 build
  sandbox, Phase 3 live-exploration hunters with scoped Bash/Edit/Write, Phase 3.5
  adversarial self-challenge, cross-session false-positive memory, and Phase 7
  dismissals writeback. Companion mythos-commit.sh adds SHA-3-256 finding commitment.
• scripts/archive/pass-at-k.sh — the v2-era standalone diversity driver; in v3+ this is folded
  into the main orchestrator via --pass-at-k K.

See CHANGELOG.md for the prose version.

Acknowledgements

Mythos Research Edition is an outside-in replication of Anthropic's published research:

• Project Glasswing / claude-mythos-preview — Anthropic's red-team research release, April 2026.
  red.anthropic.com/2026/mythos-preview/

The sink-catalog approach draws on decades of static-analysis practice (Semgrep, CodeQL, cppcheck,
Coverity); the agentic-hunter shape is contemporaneous work by many groups and is, at its core, the
same pattern Anthropic describes in their paper.

Further reading

• RESEARCH.md — full research analysis: what Glasswing actually does, the benchmark
  gap, what scaffolding can and cannot close, prompting techniques that work, multi-agent patterns.
• dist/Mythos-Research-Edition.pdf — the report
  as a publication-ready PDF.
• paper/ — arXiv-ready LaTeX source (paper.tex + references.bib + Makefile).
• scripts/V3_DESIGN.md — v3 design doc (goals, deltas to v2, metrics).

Cite

If you use Mythos Research Edition in academic or professional work, please cite the report and the
repository. A machine-readable CITATION.cff is provided at the repository root; GitHub renders a
"Cite this repository" button from it. Suggested BibTeX:

@techreport{hardani2026mythosResearch,
  author       = {Hardani, Keyvan},
  title        = {An Outside-In Replication of Project Glasswing: Mythos Research Edition},
  institution  = {Independent},
  year         = {2026},
  month        = apr,
  doi          = {10.5281/zenodo.19727857},
  url          = {https://doi.org/10.5281/zenodo.19727857},
  note         = {ORCID 0009-0000-6003-8826.
                  Concept DOI (always-latest). For version-specific citation:
                  10.5281/zenodo.20022293 (v2.0.0, current),
                  10.5281/zenodo.19727858 (v1.0.2).}
}

License

Apache License 2.0. See LICENSE.

The licence permits use, modification, and redistribution for lawful purposes, including
commercial use. Use against systems without explicit authorisation is outside the intended
scope. Coordinated disclosure is expected for any vulnerability surfaced with the help of
this scaffold.

Author

Keyvan Hardani — Applied AI Researcher · Engineer.
keyvan.ai · github.com/Keyvanhardani · linkedin.com/in/keyvanhardani · ORCID 0009-0000-6003-8826 · [email protected]