Anthropic’s Next-Gen AI Model Exposed in Data Leak Ahead of Launch
Anthropic has acknowledged a data leak exposing details about Claude Mythos (internally codenamed Capybara), a new AI model the company describes as a "step change" in capabilities. The breach, discovered by security researchers Roy Paz of LayerX Security and Alexandre Pauwels of the University of Cambridge, stemmed from a misconfigured content management system (CMS) that left nearly 3,000 unpublished assets including a draft blog post publicly accessible. Anthropic attributed the incident to "human error" in the CMS settings, which defaulted to public URLs unless manually restricted. The company secured the data after being alerted by Fortune on Thursday.
The leaked documents reveal Capybara as a fourth, premium-tier model positioned above Anthropic’s current flagship Opus line. According to the draft, it outperforms Claude Opus 4.6 which recently topped Terminal-Bench 2.0 with a 65.4% score across software coding, academic reasoning, and cybersecurity benchmarks. Anthropic confirmed the model’s development, calling it "the most capable we’ve built to date" but emphasizing a cautious rollout due to its advanced capabilities.
Cybersecurity risks are a key concern. The draft warns that Mythos is "far ahead of any other AI model in cyber capabilities," raising fears of accelerated vulnerability exploitation that could outpace defensive measures. In response, Anthropic plans to restrict early access to cyber defense-focused organizations, allowing them time to bolster protections. The company has previously intervened in misuse cases, including disrupting a Chinese state-sponsored campaign that leveraged Claude to infiltrate 30 organizations. Earlier tests also demonstrated how Claude could be repurposed as a malware factory within hours.
Additional leaked materials included details about an invite-only retreat for European CEOs at an 18th-century English manor, hosted by Anthropic CEO Dario Amodei. The event is part of a series the company has held over the past year.
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
"id": "ANT1774621550",
"linkid": "anthropicresearch",
"type": "Breach",
"date": "3/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Artificial Intelligence',
'name': 'Anthropic',
'type': 'Company'}],
'attack_vector': 'Misconfigured CMS',
'data_breach': {'number_of_records_exposed': 'Nearly 3,000 unpublished assets',
'sensitivity_of_data': 'High (unreleased AI model '
'capabilities, strategic plans)',
'type_of_data_compromised': 'AI model details, draft blog '
'posts, internal event '
'information'},
'description': 'Anthropic acknowledged a data leak exposing details about '
'*Claude Mythos* (internally codenamed *Capybara*), a new AI '
"model described as a 'step change' in capabilities. The "
'breach stemmed from a misconfigured content management system '
'(CMS) that left nearly 3,000 unpublished assets, including a '
'draft blog post, publicly accessible. The company secured the '
'data after being alerted by *Fortune*.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'premature exposure of sensitive AI '
'model details',
'data_compromised': 'Details about *Claude Mythos* (Capybara), '
'including draft blog posts, model '
'capabilities, and internal event details',
'systems_affected': 'Content Management System (CMS)'},
'post_incident_analysis': {'root_causes': 'Human error in CMS configuration '
'(default public URLs)'},
'references': [{'source': 'Fortune'},
{'source': 'LayerX Security (Roy Paz)'},
{'source': 'University of Cambridge (Alexandre Pauwels)'}],
'response': {'communication_strategy': 'Public acknowledgment of the incident '
'and confirmation of model development',
'containment_measures': 'Secured the misconfigured CMS after '
'being alerted'},
'title': 'Anthropic’s Next-Gen AI Model Exposed in Data Leak Ahead of Launch',
'type': 'Data Leak',
'vulnerability_exploited': 'Human error in CMS settings (defaulted to public '
'URLs unless manually restricted)'}