Claude Mythos Preview's zero-days: the FreeBSD, OpenBSD and Firefox patches businesses needed to apply

On April 7, 2026, Anthropic published research on Claude Mythos Preview, a model it is not releasing generally, and launched Project Glasswing to give critical-software partners such as AWS, Apple, Google, Microsoft, Cisco, CrowdStrike and the Linux Foundation access for defense. Anthropic says nearly all of the vulnerabilities were found without human intervention after an initial prompt, and that over 99% of them were still unpatched when it posted, so most details are being withheld until fixes ship.

The clearest patch to apply is FreeBSD-SA-26:08.rpcsec_gss (CVE-2026-4747), published March 26 and credited to Nicholas Carlini using Claude. A stack overflow in RPCSEC_GSS packet validation lets a client attack the kernel NFS server when kgssapi.ko is loaded; FreeBSD says the client does not need to authenticate first, and Anthropic describes it as a 17-year-old remote root bug. Fixed releases are 15.0-RELEASE-p5, 14.4-RELEASE-p1, 14.3-RELEASE-p10 and 13.5-RELEASE-p11, with no workaround. OpenBSD 7.8 errata 025 (March 25) fixes a kernel crash from invalid TCP SACK options, which Anthropic calls a 27-year-old bug.

Browsers followed. Mozilla says Firefox 150, released April 21, fixed 271 vulnerabilities found in an initial evaluation with an early Mythos Preview, after an earlier Opus 4.6 scan led to 22 fixes in Firefox 148. Mozilla's advisory MFSA 2026-30 credits Anthropic researchers using Claude for CVE-2026-6746, a high-impact use-after-free in the DOM, and two moderate WebAssembly bugs (CVE-2026-6757 and CVE-2026-6758). Anthropic also says three FFmpeg bugs the model found were fixed in FFmpeg 8.1.