A hypothesis — grounded in confirmed reporting — about what’s really been happening inside the world’s most secretive AI lab
There is a version of the Anthropic story that gets told often. A scrappy safety-focused AI lab, spun out of OpenAI in 2021 by Dario and Daniela Amodei and a small group of researchers, quietly built a series of well-regarded models while its flashier rivals captured headlines. Then, sometime around 2025, something changed. The products started multiplying. The benchmarks started jumping. The revenue started compounding. The valuation started doing things that made even seasoned venture capitalists reach for superlatives.
That is the version of the story that fits into press releases and funding announcements.
There is another version — the one this article is about.
It begins with a whisper, picked up by a few people paying very close attention, and then confirmed accidentally by Anthropic itself in one of the more remarkable data leaks in recent tech history. The whisper had a name: Mythos.
This is a hypothesis. It is clearly labeled as such. But it is a hypothesis built on confirmed facts, public filings, benchmark data, and the kind of careful inference that serious technology analysis demands.
The core argument is this: Anthropic trained a breakthrough model well before announcing it, has been running that model internally as a force multiplier across its entire operation, and has been using it — among other things — to improve itself into something that can eventually be offered to the public.
The explosion of products, the impossible efficiency gains, the anomalous velocity of releases: all of it becomes considerably more legible if you assume a secret model at the center of the machine.
Let’s walk through the evidence.
The Leak That Changed Everything
On March 26, 2026, Fortune reporter Beatrice Nolan published a story that Anthropic almost certainly did not want written. While investigating Anthropic’s content management system, she discovered that nearly 3,000 assets — images, PDFs, audio files, and draft blog posts — had been left in an unsecured, publicly accessible data cache, accessible to anyone who knew where to look. The cache had not been made private because of a configuration error in Anthropic’s external CMS tool. Anthropic characterized it as “human error.” They are probably right about that. But the human error produced a remarkable window.
Among those 3,000 assets was a draft blog post announcing a new AI model. The model had two names in the document: Claude Mythos and Capybara. The document described it as “by far the most powerful AI model we’ve ever developed.” When Fortune reached Anthropic for comment, the company confirmed the model’s existence — calling it a “step change” in AI performance — but framed its release carefully, noting it was currently available only to a “small group of early access customers.”
Two independent cybersecurity researchers, Roy Paz of LayerX Security and Alexandre Pauwels of the University of Cambridge, separately verified and assessed the leaked documents at Fortune’s request, confirming their authenticity.
Mashable’s Matt Binder reported that the leaked draft described Capybara as a new tier of model sitting above Opus — the highest tier Anthropic had previously offered publicly — and quoted the document’s own framing: “‘Capybara’ is a new name for a new tier of model: larger and more intelligent than our Opus models — which were, until now, our most powerful.”
The document also disclosed that the model was expensive to run and not yet ready for general release. It emphasized unprecedented cybersecurity risks, describing Mythos as “currently far ahead of any other AI model in cyber capabilities” and warning that it “presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders.”
That is the confirmed foundation. Everything else in this article is inference, interpretation, and hypothesis — but inference built on those confirmed facts.
The Anomaly: Anthropic’s Impossible Velocity
To understand why the Mythos hypothesis is compelling, you need to first appreciate just how strange Anthropic’s recent trajectory looks when viewed from the outside.
In the early months of 2025, Anthropic was a respected but still secondary player in the AI race. Its models were praised by power users and AI researchers, but ChatGPT dominated consumer mindshare and Google had resources that Anthropic could not dream of matching. Anthropic’s annualized revenue was estimated at roughly $1 billion.
Then something happened.
By August 2025, that number had risen to $5 billion — a five-fold increase in roughly eight months. By year-end, projections put the figure at $9 billion, according to analysis from UncoverAlpha. The company’s valuation went from $61.5 billion in March 2025 to $183 billion by September, and was reportedly approaching $350 billion by late 2025 in a new funding round — a near-six-fold increase in valuation in under a year.
That is not a normal technology growth curve. That is something else.
Products launched and scaled at speeds that defy conventional explanation. Claude Code, which launched as a research preview on February 24, 2025, reached a $1 billion annualized run rate within six months — a velocity that the same analysis notes “even ChatGPT didn’t match.” By January 2026, Claude Code’s estimated ARR may have been closer to $2 billion, based on the acceleration seen in its VS Code install data, which surged from 17.7 million daily installs to over 29 million in a matter of weeks.
The Model Context Protocol (MCP) — a technical standard Anthropic developed for connecting AI models to tools and data — hit 100 million monthly downloads and, according to Anthropic’s own announcement, “became the industry standard” for its category. Skills, Claude in Chrome, Claude for Slack, Claude for Excel, Claude for PowerPoint, Claude Cowork, and multiple other integrations all launched in rapid succession.
Simultaneously, the underlying models themselves kept improving at rates that outpaced the broader industry. Claude Opus 4 launched in May 2025 with a 72.5% score on SWE-bench Verified, the gold standard coding benchmark. By November 2025, Claude Opus 4.5 had reached 80.9% on the same benchmark — while simultaneously coming with a 67% price reduction compared to the Opus 4.1 model released just a few months earlier. Better and dramatically cheaper, simultaneously, in months.
IntuitionLabs’ deep technical analysis of the Claude 4 family notes this pattern explicitly: “Compared to our previous best model, Claude Opus 4.6, Capybara gets dramatically higher scores on tests of software coding, academic reasoning, and cybersecurity, among others.” Each generational jump in the released models was large. The pace was relentless. The cost curve bent dramatically downward while capability bent upward.
In isolation, you could attribute any one of these developments to talented engineering and smart product strategy. Taken together, they suggest something more systematic at work. They suggest a model that no one outside Anthropic could see.
The Three Roles: Mythos as Internal Force Multiplier
Here is the core of the hypothesis: Anthropic completed training on Claude Mythos — or a close predecessor to it — well before the leak confirmed its existence. Rather than rushing it to market, they have been running it internally in at least three distinct capacities, each of which leaves a detectable fingerprint in the public record.
Role One: Product Accelerator
The first role is the most intuitive. A model substantially more capable than anything available to competitors can function as an internal development force multiplier of extraordinary power. It can write code faster, debug more effectively, generate more diverse test cases, synthesize research, and design systems that human engineers then review and refine.
The evidence for this is not entirely circumstantial. In January 2026, Anthropic’s announcement of its Labs structure included a remarkable admission from Boris Cherny, Head of Claude Code at Anthropic: “Claude Code generated roughly 80% of its own code.” The model was substantially building itself. That is a statement about the public-facing Claude Code models. The natural question is: what was driving those models’ capabilities, and what did the engineers use internally while building the tools that eventually reached the public?
The product launch timeline tells its own story. From a standing start in early 2025, Anthropic shipped a terminal-based AI coding agent, a Model Context Protocol that became an industry standard, integrations with Slack, Excel, and Chrome, a graphical interface for non-technical users (Cowork), a new organizational structure (Labs), and dozens of API and feature improvements — all while simultaneously releasing multiple new model generations. This is not the output of a company operating at normal speed. This is a company with an unfair advantage in its own internal tooling.
If Mythos or a predecessor had been running internally since late 2024 — helping design architectures, write infrastructure code, generate training pipelines, prototype features, and accelerate research — the observed output velocity becomes considerably more plausible.
Role Two: Distillation Engine
The second role is more technically specific and, in some ways, more significant. It concerns the question of how Anthropic managed to make its models simultaneously much better and much cheaper in rapid succession — a combination that, historically, tends to require years of engineering effort.
The mechanism is called knowledge distillation. When a more powerful “teacher” model is available, it can be used to generate training data, evaluate outputs, and provide richer learning signals for smaller, more efficient “student” models. The student models learn to approximate the behavior of a teacher they will never quite match — but they can get remarkably close, at a fraction of the compute cost.
The benchmark data strongly suggests something like this is occurring. Consider the SWE-bench trajectory: Claude Opus 4 at 72.5% in May 2025. Claude Sonnet 4.5 at 77.2% in September — a smaller model exceeding the previous flagship. Claude Opus 4.5 at 80.9% in November, at a 67% lower price point than the model it was upgrading.
That kind of trajectory — capability going up while cost goes dramatically down, in a matter of months — is the fingerprint of effective distillation from a significantly more capable model. You do not get those efficiency gains without something to distill from.
The leaked Mythos document is explicit that the model dramatically outperforms Claude Opus 4.6 on coding, reasoning, and cybersecurity benchmarks. If Mythos was available as a training signal and evaluation oracle during the development of the 4.5 model family, the observed improvements become mechanistically coherent. You are not improving incrementally through gradient descent and better data curation alone. You are compressing the knowledge of a far more capable system into a more efficient architecture.
This would also explain why Anthropic’s model efficiency has improved faster than competitors who lack an equivalent internal teacher model. The gap between what the public sees and what Anthropic has running internally may function as a permanent efficiency advantage — the further ahead the internal model is, the more room there is to distill capability into cheaper consumer-facing models.
Role Three: The Self-Improvement Loop
The third role is the most speculative, and also the most significant if true. The leaked documentation describes Mythos as “currently far ahead of any other AI model in cyber capabilities” and warns that it can “exploit vulnerabilities in ways that far outpace the efforts of defenders.”
Anthropic has already documented real-world cases where adversaries attempted to weaponize Claude against enterprise targets; Fortune’s reporting noted that “a Chinese state-sponsored group had already been running a coordinated campaign using Claude Code to infiltrate roughly 30 organizations — including tech companies, financial institutions, and government agencies — before the company detected it.”
A model with those capabilities can do something interesting when pointed at its own infrastructure: it can find bugs, security vulnerabilities, inefficiencies, and architectural weaknesses with a thoroughness that human engineering teams cannot match at comparable speed. Anthropic’s own leaked documentation framed the early access program around giving cybersecurity defenders “a head start in improving the robustness of their codebases.” If that is what Mythos can do for external codebases, it is difficult to imagine that Anthropic has not been using it on its own.
More broadly: a model this powerful, applied to the problem of making itself cheaper to run, is exactly the mechanism you would deploy if you had a model too expensive for general release but too valuable to keep entirely off limits. You use it to find optimizations in its own architecture, inference pathway, and training pipeline. You use it to identify which capabilities are computationally expensive and which can be approximated by smaller modules. You use it, in essence, to engineer the path from “too expensive to deploy publicly” to “viable as the next Opus.”
This is the flywheel. The model helps build products that generate revenue. The revenue funds compute for more model training. The model helps compress itself into cheaper versions. The cheaper versions reach more users. More users generate data and feedback that improves the next generation. And somewhere in the center of that loop, a model that no one outside the company has officially seen is quietly making it all go faster.
Reading Between the Lines: Evidence in Plain Sight
Several pieces of public information, which seemed individually unremarkable at the time, take on a different character when viewed through this lens.
The “human error” framing of the leak itself. Anthropic was quick to attribute the data exposure to a configuration error in a third-party CMS tool. That explanation is almost certainly accurate — the mechanism is well understood, and the security researchers who assessed the leak confirmed it. But it also means that a draft blog post announcing Mythos had already been written and uploaded — sitting in the CMS, nearly ready for publication — before the leak forced Anthropic’s hand. This was not a research document or an internal whitepaper. It was a structured product announcement, complete with headings, a publication date, and marketing language. The model was closer to public release than anyone outside the company knew.
The “early access customers” disclosure. Anthropic’s official statement confirmed that Mythos was already being tested with “a small group of early access customers.” This is a normal product launch pattern, but it confirms that the model has been running in production environments outside Anthropic’s own walls. Select enterprise customers have been using it, presumably under NDA, for an unknown period of time. This is not a theoretical model. It is deployed.
The Capybara tier structure. The decision to create an entirely new model tier — above Opus, which was previously the highest — signals that Mythos/Capybara is not an incremental improvement over current flagship models. Anthropic does not introduce new naming tiers casually. The last time the company introduced a new tier was when it launched the Haiku/Sonnet/Opus structure with Claude 3. The decision to introduce a “Capybara” tier suggests the capability gap between Mythos and Claude Opus is large enough that it would be misleading to simply call it “a new Opus.” It is in a different category.
The specific emphasis on compute cost. The leaked document explicitly noted that the model was expensive to run and not yet ready for general release. This is not a safety-only explanation — Anthropic has released models with significant safety caveats before. The compute cost framing is the honest explanation, and it is also the most revealing one. It means Mythos is almost certainly running on a scale that makes per-query costs prohibitive for a consumer product, but not prohibitive for an organization running it on targeted internal workloads. That is exactly the profile of an internal tool rather than a public product.
The Economics of Secrecy
There is a straightforward business logic to keeping Mythos quiet, and it does not require any malicious intent or deliberate deception to explain.
If Anthropic had announced Mythos publicly the moment training completed, several things would have happened immediately. Competitors would have known precisely what capability gap they needed to close — and what timeline they were working against. Enterprise customers who had recently signed contracts for Opus would have demanded to know when they could access the superior model, creating pressure to either accelerate an unprofitable launch or absorb customer dissatisfaction. And a wave of “wait and see” behavior would have dampened near-term subscription and API revenue.
By keeping Mythos internal — deploying it selectively to early access customers under controlled conditions, using it as a development and distillation tool, and releasing only the downstream improvements it enabled — Anthropic got the benefit of the capability without the competitive intelligence leak. The model’s existence was an asset precisely because it was not public.
The leak changes this calculus. Anthropic can no longer manage the narrative on its own timeline. The Quartz analysis noted that the leaked documents outlined “a cautious rollout strategy for the model, beginning with a small group of early-access users” — a strategy that has now been publicly disclosed before Anthropic chose to disclose it. The product launch will happen faster than planned, under conditions Anthropic did not choose.
In a strange way, this may ultimately benefit the company. The leak generated enormous public interest and confirmed, in ways that carefully managed press releases never quite do, that Anthropic is operating at a capability level that exceeds what the public had access to. That is a powerful signal to enterprise customers evaluating AI vendor relationships.
What Comes Next
The leaked document described Mythos as already trained and already in customer testing. The Capybara tier announcement appears imminent — the draft blog post was complete, the framing was ready, and the only remaining variable is Anthropic’s internal timeline for managing the cybersecurity implications of a broad release.
Those implications are not trivial. The leaked document’s warnings about Mythos being “far ahead of any other AI model in cyber capabilities” and “presaging an upcoming wave of models that can exploit vulnerabilities in ways that far outpace defenders” are not boilerplate safety language. They reflect a genuine calculation Anthropic appears to be wrestling with: how do you release a model that, in the wrong hands, represents a qualitative escalation in offensive cybersecurity capability?
The answer the leaked document outlined was to prioritize cyber defenders in the early access program — giving organizations that protect systems a head start before the model becomes available to whoever would exploit it. Whether that approach is sufficient is a question that extends well beyond this article. But it is evidence that Anthropic has been thinking seriously about the implications, and that the caution around release is substantive, not theatrical.
Beyond cybersecurity, the Mythos release will test whether the Capybara tier can generate the revenue to justify its compute costs at scale. The 67% price reduction seen with Opus 4.5 suggests that the distillation pipeline is working — that lessons from training more powerful models are being successfully compressed into more efficient ones. Mythos itself, at launch, will likely be expensive. But the pattern of Anthropic’s model releases over the past year suggests that the Capybara tier today becomes the heavily discounted Opus tier within twelve to eighteen months.
If the flywheel hypothesis is correct, the more interesting question is not about Mythos itself — but about what Mythos has already produced. Every model in the Claude 4.x family may be, in some meaningful sense, a Mythos derivative. Every product that launched in the past year may have been built with tools that no competitor had access to. The public releases are the effluent of a private capability. The real advantage is upstream.
Counterarguments Worth Taking Seriously
Intellectual honesty requires acknowledging the alternative explanations.
Anthropic has hired aggressively. Its engineering team expanded dramatically through 2025, and it has attracted talent from across the industry, including experienced researchers from OpenAI, Google DeepMind, and academic AI labs. Talented people working at high intensity on well-scoped problems can produce output that looks anomalous from the outside without requiring a secret model to explain it.
The efficiency gains in the 4.5 model family could reflect genuine research breakthroughs in training methodology, architecture improvements, or data curation — not necessarily distillation from Mythos. The field of AI efficiency research has been moving fast, and Anthropic has published significant work on training techniques.
It is also possible that Mythos was completed more recently than the flywheel hypothesis requires. If training finished in late 2025 or early 2026, it could not have been powering the product acceleration seen throughout 2025. The timeline is a real constraint on the hypothesis.
And the leak, while genuine, captures a draft document — not a final accounting of Mythos’s history or internal use. What the document says about capabilities and cybersecurity risks is confirmed. What it implies about how long Mythos has been running internally, and in what capacities, remains speculation.
These are genuine counterarguments. They do not disprove the hypothesis. But they establish that “Mythos as secret internal flywheel” is one plausible story among several, not the only possible explanation for what Anthropic has accomplished.
Conclusion: The Two-Track AI Industry
There is a version of the AI industry that exists in public — the models that get announced, benchmarked, written about, and debated. Claude Opus, GPT-5, Gemini Ultra. This is the version that shapes market perception, drives enterprise procurement decisions, and generates the news cycle.
And then there is the version that exists in the research labs, behind NDAs and internal deployment environments, accessible only to the people building the next generation of models and the select customers testing them before launch. This version leads the public version by an unknown interval, which each lab guards carefully.
The Mythos leak is a rare glimpse into that interval. Fortune’s confirmed reporting establishes that Anthropic has a model in production that it describes as a “step change” beyond anything it has released publicly — a model too expensive to deploy broadly, currently in carefully managed early access, representing capabilities that its own team believes are unprecedented in cybersecurity specifically.
The hypothesis this article has argued is that this model, or a close predecessor, has been running internally for longer than the leak implies — and that its existence is the most coherent explanation for the anomalous velocity of Anthropic’s public output over the past year. The products that seem too numerous to have been built at normal speed. The efficiency gains that seem too large to have been achieved without a more powerful training signal. The benchmark trajectory that bends upward even as the price curve bends sharply down.
If that hypothesis is correct, the implications extend beyond Anthropic. It would suggest that the AI industry’s competitive dynamics are not primarily playing out in the public model releases that dominate the coverage — but in the hidden capability gaps between what labs have built and what they have chosen to show. The leading labs are not just racing each other to build more powerful models. They are racing to exploit the advantages of models they already have, compressing those advantages into products and releases that the public can access, while the real frontier moves further ahead in private.
Mythos was whispered about. Now it is confirmed. The question is what comes after it, in the layer of capability that is still, for now, not yet being whispered at all.
