Claude Mythos

Robert Campbell

Anthropic’s April 2026 Claude Mythos Preview release established a new operational threat category: frontier AI systems whose extended-context reasoning, recursive self-correction, native system-tool integration, and agentic scaffolding render dominant AI safety paradigms—RLHF, output filtering, contractual access vetting, human-in-the-loop supervision—insufficient as sole controls. This paper develops a defense-in-depth reference architecture against that category, structured around four named contributions: a five-indicator operational definition of the Mythos-class (capability conjoined with scaffold, access pattern, autonomy depth, and persistence); the Mythos-Class Posture Rubric (MCPR), a three-tier detection framework spanning evaluation, deployment, and runtime with explicit routing to mitigation layers; a four-layer mitigation stack comprising the Vetted-Access Operational Pattern (VAOP), Authority-Bound Output Release (ABOR) cryptographically grounded in FIPS 203/204/205 post-quantum primitives, and the Compute-Plane Isolation Profile (CPIP); and an integrated architecture that crosswalks to the NIST AI Risk Management Framework, NIST Cybersecurity Framework 2.0, and CISA Zero Trust Maturity Model 2.0. The architecture is applied to three deployment surfaces—post-quantum cryptography migration, federal AI supply-chain assurance, and critical-infrastructure operational technology defense—demonstrating that the four contributions generalize across heterogeneous operational contexts. The contribution is a reference design rather than a deployed system; limitations, falsifiability criteria, and a research agenda for empirical refinement are developed.

Dominik Blain

The April 2026 Claude Mythos sandbox escape exposed a critical weakness in frontier AI containment: the infrastructure surrounding advanced models remains susceptible to formally characterizable arithmetic vulnerabilities. Anthropic has not publicly characterized the escape vector; some secondary accounts hypothesize a CWE-190 arithmetic vulnerability in sandbox networking code. We treat this as unverified and analyze the vulnerability class rather than the specific escape. This paper presents COBALT, a Z3 SMT-based formal verification engine for identifying CWE-190/191/195 arithmetic vulnerability patterns in C/C++ infrastructure prior to deployment. We distinguish two classes of contribution. Validated: COBALT detects arithmetic vulnerability patterns in production codebases, producing SAT verdicts with concrete witnesses and UNSAT guarantees under explicit safety bounds. We demonstrate this on four production case studies: NASA cFE, wolfSSL, Eclipse Mosquitto, and NASA F Prime, with reproducible encodings, verified solver output, and acknowledged security outcomes. Proposed: a four-layer containment framework consisting of COBALT, VERDICT, DIRECTIVE-4, and SENTINEL, mapping pre-deployment verification, pre-execution constraints, output control, and runtime monitoring to the failure modes exposed by the Mythos incident. Under explicit assumptions, we further argue that the publicly reported Mythos escape class is consistent with a Z3-expressible CWE-190 arithmetic formulation and that pre-deployment formal analysis would have been capable of surfacing the relevant pattern. The broader claim is infrastructural: frontier-model safety cannot depend on behavioral safeguards alone; the containment stack itself must be subjected to formal verification.

2. April, G. Mako

2. April, A. Shortland

Diego Honorato