I’ve been trying to get real work done, but the Mythos disaster keeps landing in my inbox, so here’s a quick nod.
Remember Cybernews framing of the CVE-2026-5873 demo? The researcher “intervened when the model became stuck, redirecting it and providing debugging feedback.” That’s Clever Hans. The horse isn’t counting. The handler is cueing the horse. Clever Mythos.

Alisa Esage has posted claims of a Google Chrome exploit she found. “Zero dupes so far” with Mythos. If Anthropic’s disclosures to Google covered the frontier, we should expect overlap with what she is reporting. She reports none.
That throws Glasswing under the big vulnerability bus. The April 7 Mythos rollout positioned the model as discovering apex-target bugs at scale. CVE-2026-5873 in V8, multi-chain renderer-plus-OS sandbox escape, the “too dangerous to release” label. If the model were operating where Esage operates, the two sets would intersect. They don’t.
Her business depends on the market for human-found Zero-days. Anthropic’s Mythos narrative attempts to price her out by running a cartel. She made a falsifiable claim anyway, timestamped, in public. Anthropic holds the disclosure set that would settle the dispute in one post. Let’s see it.
I write about this because I’ve spent a long career finding, reporting, triaging and managing vulns, and because the industry needs to take a hard look at the sudden threat to common sense from a non-security corporation suddenly, without expertise, trying to corner the security market. My business of putting out fires isn’t threatened by a sloppy fire-starter like Mythos. If anything they are generating a boom for security professionals who have to clean up their mess. I appreciate what Esage is saying and why, because she’s proving the mess.
Anthropic is clearly attempting to fence the entire security industry. Controlling what counts as a finding. What gets disclosed. Which CVE numbers get briefed to press. How the resulting narrative gets shaped.
Google receives the submissions. Reporters write the receipt. Nobody in the corrupted loop of the Church of Anthropic has to demonstrate that disclosed bugs sit anywhere near the actual exploitation frontier. The resolution mechanism sits inside the claimant. Centuries of enlightenment spent building external verification, abandoned for a press release.
Look at the “call 0x41414141“.

She landed the hardest primitive class on a target where the mitigation stack is designed to prevent exactly that. That’s damning evidence. Zero dupes from someone demonstrating that level of control is a substantive technical smackdown on Anthropic’s capability. Esage posted a view of the unassisted frontier for a reason. Mythos is NOT on it.
Sorry Clever Mythos, you’ve been served.







