The Singularity Arrived as a Security Incident

Inside the Anthropic Mythos leak and the growing distance between the people building AI and the rest of us

On Thursday, a misconfigured content management system at Anthropic left roughly three thousand unpublished blog assets in a publicly searchable data store. Two cybersecurity researchers, working independently, found them. Among the files was a draft product announcement describing a new model referred to as Claude Mythos, associated with a possible new model tier the draft called Capybara, positioned above the current flagship Opus line. Anthropic confirmed it is developing and testing a new model, called it a step change, said it was in early testing with a small group of customers, and locked the data store down. The company also noted the exposed files were early drafts of content considered for publication, which means the names themselves may not survive to launch.

That is the story. What follows is what the internet did with it, what the details actually tell us, and why the gap between the two might matter more than the model itself.

Within hours, the AI commentariat was running at full tilt. The training run is already finished. Multiple unannounced breakthroughs have occurred across more than one lab. Capabilities are increasing faster than anyone outside the industry realises. We are already inside the singularity. That was the tenor of the response from people who track frontier AI closely, and it spread fast. Others were more cautious. Most people, of course, did not see the story at all. It arrived on a Thursday evening and by Saturday morning it was competing for attention with everything else.

It may turn out to be nothing much. A bigger model, better benchmarks, an incremental step dressed in the language of step changes because that is how you launch products. It may turn out to be significant. The honest answer is that we do not have enough information to tell, and the speed with which people have decided which it is says more about their priors than about the model.

One detail in the draft, though, is easy to miss in the excitement and worth pulling forward. The model is expensive. The draft says it repeatedly: expensive to run, more expensive than Opus, not ready for general release. Whatever this new tier ends up being called, it is not just a new tier of capability. It is a new tier of cost. More power is coming, but not cheaply, and that fact shapes everything about who gets access, when, and what the gap between early adopters and everyone else looks like over the next twelve months.

So let us look at what we actually have.

The leaked draft describes a model it calls Claude Mythos, placed in what it calls a new tier, Capybara, above Opus, which was until now Anthropic’s most capable line. Whether those names are final branding or working labels is unclear; Anthropic described the exposed material as early drafts. What the draft does claim is dramatically higher scores than Claude Opus 4.6 across software coding, academic reasoning and cybersecurity. It is not ready for general release and is currently in limited testing. It leads with cybersecurity as its primary concern, claiming the new model is far ahead of any other AI model in cyber capabilities and that it presages a wave of models that can exploit vulnerabilities faster than defenders can respond. The proposed rollout frames early access as defensive: organisations get the model first so they can harden their codebases before wider availability.

That is the verified signal. Anthropic confirmed it. Fortune reviewed the documents. Two independent researchers located the material separately.

Now here is what we do not know. The model’s parameter count remains undisclosed. A figure of ten trillion has been circulating on X, but it appears to be social media rumour with no support in the leaked draft or in anything Anthropic has said. Modern architectures have evolved past the point where raw parameter numbers are a reliable proxy for capability. The specific benchmark scores are absent too; we have the comparative claim, dramatically higher than Opus 4.6, but not the absolute numbers. Pricing specifics are absent; we know it costs more than Opus, but whether that translates to higher API token costs, steeper enterprise contracts or new subscription tiers is anyone’s guess. And the release timeline is unclear. The draft had a publication date embedded in it, but Anthropic has given no indication it plans to stick to whatever schedule existed before Thursday evening.

That is a lot of unknowns for a story that has already been used to declare the singularity.

The extrapolation problem is worth naming directly. We have a comparative claim about one model against its predecessor, wrapped in language designed for a product launch blog post. From this, people have built a civilisational narrative. The speed of that construction tells you something about where the AI discourse is right now: primed for take-off stories, hungry for confirmation, and largely unable to hold ambiguity for more than a few hours. The model might be extraordinary. It might be a solid improvement that corporate marketing has framed as a leap. We will not know until benchmarks, independent evaluations and real-world deployment provide something other than Anthropic’s own characterisation. Every frontier lab calls its latest model the most capable ever built. That is not lying. It is also not evidence of a phase transition.

That said, the leak does not exist in isolation, and the context around it is worth taking seriously even if the commentary has been overheated.

Dario Amodei has been saying, with increasing explicitness, that progress is not slowing. In “The Adolescence of Technology,” published in January, he argued that behind public volatility there has been a smooth, unyielding increase in cognitive capabilities and claimed that AI now writes much of the code at Anthropic, accelerating progress toward the next generation. At a Council on Foreign Relations session in March 2025, he predicted AI would be writing ninety per cent of code within months. In May 2025, he told Axios that AI could wipe out roughly half of entry-level white-collar jobs within one to five years, saying leaders were sugar-coating what was coming. In February 2026, talking with Dwarkesh Patel, he described a middle world between stasis and instant Dyson spheres: extremely fast, not instantaneous, constrained by the messy realities of organisational adoption.

Mythos slots into this arc. Each statement from Amodei has been a little more explicit, a little less hedged. If you take the public record at face value, the leak looks like confirmation of a trajectory he has been describing for over a year.

But the history of AI is littered with moments that felt like take-off and turned out to be plateaus with better marketing. It is also littered with moments dismissed as hype that turned out to be inflection points visible only in retrospect. Insiders who work close to the frontier have access to information the rest of us do not, and their pattern-matching may be better calibrated than ours. It may also be distorted by proximity. Epistemic humility cuts both ways. The appropriate response to claims you cannot independently verify is not belief, not disbelief, but careful attention to what can be verified and a willingness to update when more becomes clear.

What can be verified is the compute infrastructure, and here the numbers are large enough to be worth stating plainly. In October 2025, Anthropic expanded its relationship with Google Cloud across TPUs, Trainium chips and NVIDIA GPUs. Reuters reported the deal involved access to as many as one million TPUs, worth tens of billions, with more than one gigawatt of compute coming online this year. On the Amazon side, Project Rainier was described as a cluster of nearly half a million Trainium2 chips providing more than five times the compute used for previous training runs. Separately, Anthropic announced a fifty-billion-dollar investment with Fluidstack to build data centres coming online throughout 2026. Whatever Mythos is, it was trained on resources that dwarf anything the public discourse about hitting walls has accounted for. That does not prove the model is as capable as the draft claims. It does confirm that the investment thesis behind frontier AI development has not slowed, whatever the sceptics say.

Then there is the business context. Bloomberg and The Information reported, on the same day as the leak, that Anthropic was considering an IPO as early as October 2026. A model positioned as the most powerful ever built, placed above the current flagship line, foregrounded as a cybersecurity breakthrough and released first to enterprise clients, is the kind of product that anchors a valuation narrative. This does not make the model a marketing exercise. Capability can be real and timing can be strategic simultaneously. But every piece of public information about Mythos now exists within a commercial field that shapes how it is produced, distributed and received. When Anthropic calls it a step change, that is a technical assessment and a positioning statement at once. When they describe it as the most capable model they have ever built, that is presumably accurate and also the sort of thing you say when you are about to ask investors to value your company north of sixty billion dollars.

The cybersecurity angle deserves its own attention because it is the one place where the leak’s form and its content tell the same story.

Anthropic has been building a public record on cyber risk for months. In late 2025, it published a report describing what it assessed as the first AI-orchestrated cyber espionage campaign, arguing that attackers used agentic capabilities to an unprecedented degree across roughly thirty global targets. In January 2026, a separate update on cyber range evaluations noted that newer Claude models were increasingly able to execute multistage attacks using standard open-source tools. And Anthropic’s own Sabotage Risk Report for Opus 4.6 conceded that they found themselves in a grey zone where clean rule-out of ASL-4 autonomy thresholds was difficult, expecting with high probability that near-term models could cross the threshold.

The Mythos draft picks up exactly where those reports left off, foregrounding cyber as its primary risk category and framing the constrained release as giving defenders a head start.

Then the company that has been warning, with increasing urgency, that its models pose escalating cyber risk left its own product launch materials in a publicly searchable bucket because the CMS defaulted to public and nobody checked. Fortune’s second piece noted that AI coding tools now make it trivially easy to discover and correlate exactly these kinds of misconfigurations at scale. The tools Anthropic builds are the tools that make its own operational mistakes more discoverable.

I have written before about what I call symmetric alignment: the observation that we are consumed with aligning AI to human values while barely noticing that human institutions have been misaligned from human flourishing for decades. The Mythos leak is a small, faintly comic instance of the same pattern. The gap between what the system can do and what the organisation around it manages to do is not a bug. It is the condition. Anthropic is arguably the most safety-conscious frontier lab in operation. If its web publishing pipeline cannot keep pace with its model development pipeline, that tells you something about the structural relationship between building and governing that scales well beyond one company’s CMS settings.

The part of this story that stays with me, though, is not the model or the irony. It is the information gradient.

Mythos was already trained. Enterprise partners were already testing it. A CEO retreat at an eighteenth-century English manor was already being organised to sell it to European corporate customers. None of this was public. The people making decisions about how to use the most powerful model Anthropic has ever built were doing so behind NDAs and early-access agreements while the public discourse was still debating whether frontier models had hit a wall.

If the model is as capable as the draft claims, especially in cybersecurity, then the cost structure I mentioned earlier becomes the story’s sharpest edge. Early availability goes to organisations that can afford enterprise pricing. Every staged rollout of a frontier capability is also a staging of advantage. The organisations that get it first become better defended and more capable. The ones that do not become relatively more exposed. That gradient does not flatten naturally. It compounds. And a model whose own creators describe it as expensive to run is, by design, a model whose benefits accrue first to those with the deepest pockets.

Think about what this means for institutions that were already behind. Universities, hospitals, local governments, small and mid-sized businesses. Organisations whose cybersecurity postures are funded from margins already under pressure. Institutions whose working groups are still settling arguments about how to respond to the last generation of AI models. The draft from Anthropic says the model they have already built can exploit software vulnerabilities faster than defenders can respond, and the first people who get to use it defensively will be the ones who can pay for enterprise access. Everyone else waits. The gap between those two groups is not new. But a model that Anthropic itself describes as far ahead on cyber capability makes the gap more consequential than it was last week.

Nobody at next week’s committee meeting at any of these institutions will have read the Fortune article. If they had, they would not know what to do with it. Not because they are incompetent but because the institutional machinery they inhabit was not built to process information at this speed. It was built for a world where threats arrive at a pace that allows deliberation.

This is where the scepticism and the concern meet, and where I think the honest position lives. The model may or may not be as consequential as the breathless commentary suggests. The singularity language is almost certainly premature, and the ten trillion parameter claims are almost certainly fabricated. But the infrastructure is real, the compute is real, the trajectory Amodei has been describing is consistent with what the leak reveals, and the distance between the people who know what is coming and the institutions that will have to absorb what arrives is growing with every model generation.

Most people will not have seen this story. Of those who did, most will scroll past it. The ones who will act on it are the enterprise customers who already have early access. That distribution of awareness and response, quiet, ordinary, unremarkable, is the thing worth noticing. Not because it proves the singularity is here. But because it shows, in miniature, how transformative change distributes itself when the capacity to pay attention is as unevenly distributed as everything else.

A hospital administrator in regional Queensland looked at the same week and saw a staffing roster and a compliance audit. A university dean saw a curriculum review deadline. A small business owner saw a BAS statement. Andrew Curran, who follows frontier AI as closely as anyone outside the labs, looked at the same week and declared we are already inside the singularity. They are all telling the truth about what they can see. That is a problem.