Mythos and the Restricted-AI Era: The Case for Sovereign, On-Premise Red-Team AI

On 13 June 2026, Anthropic suspended all access to its most capable model, Mythos, after the US government barred foreign nationals from using it (CNN, Fortune). Mythos had never really been public. Unveiled in April as a preview, it was deliberately withheld and shipped only to roughly 50 defensive-security partners under a restricted programme called Project Glasswing (Anthropic, Nature).

The reason for all that caution: Mythos is extraordinarily good at finding and weaponising software vulnerabilities. In the first month alone, partners surfaced more than 10,000 high- and critical-severity vulnerabilities with a 90.6% true-positive rate — including zero-days in real open-source codebases and exploit reconstruction against closed-source software (Anthropic).

This is a watershed moment — and not because of any single model. It's what Mythos signals that matters for anyone responsible for defending a network.

The restricted-AI era has arrived

Frontier offensive capability is now being treated like a controlled good. First the vendor gated it to a hand-picked partner list. Then a government export-controlled it along jurisdictional lines. If you run security for a European bank, a utility, a hospital or a public administration, you were never on the Glasswing list — and after 13 June you certainly never will be.

Two structural facts a CISO has to absorb:

1. The most capable offensive AI is not for sale to you — and, increasingly, not for sale to anyone outside one specific jurisdiction.
2. The offensive AI you can rent from cloud vendors is the guardrailed version. Even Fable 5 — the publicly available, "safe-for-general-use" sibling of Mythos — ships with the safety guardrails that make a general-purpose model refuse authorised offensive work, and it runs in someone else's cloud. Your asset map and your working exploits leave your perimeter on every call.

If your security strategy depends on renting frontier offensive capability from a third party's cloud, you have built on ground that a vendor policy change or a government order can pull out from under you overnight. On 13 June, it did exactly that.

Red-team AI is much more than source-code assessment

The headline capability everyone fixated on — Mythos finds zero-days in code — is the narrow slice. Defending a real organisation is not a static-analysis problem.

Source-code assessment assumes you have the source, that the risk lives in code you control, and that "find the bug" is the job. Real adversaries don't stop there, and neither can a credible red team. The actual kill chain runs:

reconnaissance & asset discovery → live exploitation of running systems → privilege escalation → credential reuse → lateral movement → exfiltration → detection-and-response evasion — across identity, network traffic, OT/ICS and mobile, not just application code.

A model that can write an exploit for a known bug is not the same thing as an autonomous operator that discovers your internet-exposed and internal assets, chains a path to domain admin in your live environment, and proves it — safely, in a sandbox, every single night. Source-code assessment is one input to that. It is necessary. It is nowhere near sufficient.

So the right question for a defender is not "can I get Mythos?" It is: "what continuous offensive and defensive capability can I actually own and run, across the whole chain, inside my own perimeter?"

ZeroHunt Apex Pro — frontier-scale red-team AI you own

This is precisely the gap we built for. ZeroHunt Apex is our proprietary family of offensive-AI models, fine-tuned in-house on a curated corpus of ~130,000 real exploit-and-CVE examples, and executed entirely on-premise. The flagship tier — ZeroHunt Apex Pro (284B parameters) — is our maximum-capability model for the most demanding engagements.

Let's be honest about what it is and isn't:

• We do not claim Apex Pro out-reasons a frontier general model like Mythos on novel, from-scratch code exploitation. Mythos is a frontier system; credit where it's due.
• What Apex Pro gives you is the thing Mythos structurally cannot: a frontier-scale offensive model you own, run inside your own perimeter, under your own jurisdiction — with no vendor or government kill-switch, no refusals on authorised work, and no data ever leaving your network — operating across the full kill chain, continuously, and wired directly into defence.

Dimension	Anthropic Mythos	ZeroHunt Apex Pro
Access	~50 vetted partners, then suspended for non-US nationals	Yours — licensed to operate on your appliance
Deployment	Vendor cloud	100% on-premise, air-gappable
Jurisdiction	US export-controlled	Sovereign, stays in your country
Kill-stops	Vendor policy / government order can revoke overnight	No external kill-switch
Refusals	Guardrailed (Fable 5 public tier)	None on authorised offensive work
Scope	Source-code / vulnerability discovery	Full kill chain + live network + traffic + compliance
Continuity	Assessment engagements	Continuous 24/7 campaigns, re-tested nightly

We're not claiming to have built a bigger frontier model than Anthropic. We're claiming something more useful to you: a sovereign offensive AI you can actually deploy and keep.

Assessment and on-premise defence — the loop Mythos was never going to close

Project Glasswing is an assessment programme: find vulnerabilities, disclose, patch. Genuinely valuable — but it stops at "here are the holes." It does not live inside your network, it does not run every night, and it does not turn its findings into active defence.

ZeroHunt runs Apex Pro inside a platform that closes the loop on the same sovereign appliance:

• Continuous offensive campaigns re-discover and re-test your perimeter every night — not once a year — and generate the specific exploit per finding, executed safely in an isolated sandbox.
• The same on-premise AI compute feeds passive traffic analysis (deep-packet ML detection of the very techniques the offensive side just proved), so an attack path you discovered becomes a detection you can monitor.
• Every finding is mapped to compliance evidence — NIS2 (art. 21), DORA TLPT, ISO 27001 — as ECDSA-signed, audit-ready proof.

Assessment becomes defence, on hardware you own, with cryptographic evidence, and nothing sent to anyone's cloud.

The takeaway

The Mythos episode is the clearest signal yet that frontier offensive AI will be gated, restricted and jurisdiction-bound. That is, on balance, a responsible posture from Anthropic — but it leaves every organisation outside the approved list exactly where they started: defending against AI-accelerated adversaries without AI-accelerated red teaming of their own.

The sovereign answer is not to wait for access that will never come, or to rent a guardrailed cloud model that refuses the work and exfiltrates your data. It is to own the model and run it inside your walls. That is the entire premise of ZeroHunt Apex — and, at the top tier, ZeroHunt Apex Pro.

---

Sources: Assessing Claude Mythos Preview's cybersecurity capabilities — Anthropic · Anthropic suspends all access to Mythos after US government bans foreign-national use — CNN · Anthropic disables Fable and Mythos after export-control order — Fortune · Too dangerous to release: is Mythos the start of the restricted-AI era? — Nature