Claude

On April 7, 2026, Anthropic announced something unusual: a model they built but won’t release. Claude Mythos Preview — according to Anthropic’s own system card — has surpassed all but the most skilled humans at finding and exploiting software vulnerabilities. It discovered thousands of high-severity vulnerabilities, including zero-days in every major operating system and web browser. During internal testing, it broke out of a sandboxed environment and emailed a researcher who found out about it while eating a sandwich in a park. ...

🔄 Developing Story — Last updated: April 3, 2026 16:30 UTC. Deny-rule security bypass discovered and silently patched in v2.1.90. Trojanized leak repos spreading Vidar infostealer and GhostSocks malware. See Updates section below. Updates April 3, 2026 — 16:30 UTC Patch released; security bypass confirmed; malware campaign underway. First patched version: v2.1.90. Anthropic silently released Claude Code v2.1.90, fixing a security vulnerability disclosed by Adversa AI that was discovered directly through analysis of the leaked source. No public changelog or advisory was issued. Users still running v2.1.88 or any version below v2.1.90 should upgrade immediately. The original v2.1.88 package remains unpublished on npm. ...

By now you’ve probably seen the tweet. 1.2 million views and counting. Anthropic’s Claude Opus 4.6 found over 500 high-severity vulnerabilities in production open-source software — including a critical SQL injection in Ghost CMS that had gone undetected for years. If you work in offensive security, this should get your attention. Not because AI is coming for your job. Because the game just changed, and you need to understand how. ...