← The MonexusInvestigations

Inside the Discord That Hunts Unreleased AI Models: How 'Mythos' Got Found Before Anthropic Finished Locking Its Doors

A small group of Discord users accessed Anthropic's 'Mythos' — the model the company itself described as a 'step change' in AI capability — on the day it launched. They didn't hack a firewall. They guessed the URL. Bloomberg has the screenshots; Anthropic has confirmed the investigation; the pattern now visible is the one Anthropic has been unable to shake since its March configuration leak: third-party vendor surface is outpacing the company's ability to secure it.

By Moemedi Michael Poncana·americas·9-minute read·22 Apr 2026

On 21 April 2026, the same day Anthropic formally announced Claude Mythos — the successor to its Claude 4.x line, and the model the company itself described in an internal blog draft as a "step change" in performance and "the most capable we've built to date" — a small, unaffiliated group of Discord users was quietly using it. Not via a jailbreak. Not via a third-party fine-tune. Via Anthropic's own preview endpoint, accessed through a third-party vendor environment, reached by a URL the group guessed.

Bloomberg first reported the unauthorized-access episode on Monday; TechCrunch secured Anthropic's official statement later the same day: "We're investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments." Anthropic said it had found "no evidence that the unauthorized access has impacted Anthropic's core systems or extended beyond the vendor environment." The group itself showed Bloomberg screenshots and a live demonstration. Every piece of that disclosure matters, because every piece answers a different question, and none of them answers the structural question that a "step change" model produces by the fact of its existence: why did the people who run Anthropic think that Mythos Preview through a vendor environment was a surface they had time to lock down later?

The Discord is not the story. The vendor is.

The Discord channel — per the Cybersecurity News and Gizmodo accounts — is one of a small scene of semi-public "AI archaeology" rooms where hobbyists, journalists, and a handful of engineers-who-don't-currently-work-at-a-frontier-lab trade leads on unreleased models. The scene is real. It was the same scene that surfaced the March configuration leak on Anthropic's own CMS — the one that Fortune broke when a draft launch blog post, left in a public data cache, mentioned Mythos by name a month before the company was ready to. It is the same scene The Decoder was paraphrasing when it cited "dramatically higher scores on tests than any previous model" — that line was lifted directly from the leaked draft.

The April episode is the same scene applying the same technique, one generation later: once you have seen the URL conventions Anthropic uses for Claude 3, 3.5, 4.0, 4.5, 4.6, 4.7, and the short-lived 4.x experimental branches, you can guess a Mythos preview endpoint with a few dozen attempts. Some of those attempts hit a third-party vendor with an internal route to the model; one of those attempts apparently hit a vendor partly facilitated by an insider at the contractor.

That is the story the Discord gives you. But it is not the story that matters. The story that matters is the vendor.

Third-party surface as the structural gap

Zscaler, in a post-mortem of the March leak, wrote the sentence that ought to be read next to every "safety-first" press release Anthropic produces: "This wasn't a hack." The March leak was not a compromised credential, not a zero-day, not an insider exfiltration. It was a SaaS misconfiguration — an access-control checkbox left in the wrong state on a content-management system the company uses for its public-facing blog. The April vendor-environment episode is the same category of failure, one level up the stack: an access route that was not closed because someone had not yet got around to closing it.

This is not a trivial observation. It is the single most consistent pattern in frontier-model leaks across the last two years:

March 2024: OpenAI's internal employee forum breach — again, not a hack, but lateral access through inadequately-segmented internal tools.
July 2024: Google DeepMind's Gemini 1.5 prompt-leak, attributed to a partner developer who was not supposed to retain system-prompt access.
February 2025: Meta's "Llama 4 Behemoth" pre-release artefact accessible through a training-infrastructure misconfiguration.
March 2026: Anthropic CMS leak reveals Mythos exists.
April 2026: Anthropic vendor environment leak gives Discord users live access to Mythos.

Each of these is, operationally, not an attack. They are administrative oversights. The attack surface is the internal SaaS perimeter and the vendor perimeter, and the attackers are hobbyists with patience and a list of URL-naming conventions.

What Anthropic has — and has not — said

Anthropic's TechCrunch statement said three things and declined to say several others. It confirmed awareness of the incident. It scoped the blast radius to the vendor environment only. And it began an investigation. It did not say which vendor. It did not say how many users had accessed the model, or for how long, or with what rate limits. It did not say whether Mythos Preview was the same weight set Anthropic intends to offer commercially, or a subset with restricted capability. It did not say what the insider facilitation consisted of — whether credentials were shared wittingly, whether a misconfigured share was forwarded, or whether the insider simply described the URL conventions in a Discord voice chat.

Those omissions are not accidental. Anthropic has a regulatory inbox open in Washington — Monexus has previously reported that the White House is in active talks with the company for federal-agency access to Mythos, and separately that the Pentagon has begun reviewing Mythos against its AI-use blacklist criteria. A "step change" model whose preview was accessed by hobbyists two days before Washington's deal terms close is not the provenance story the company wants in the file. A vendor disclosure that cannot yet name the vendor is the defensible space to buy time in.

The market consequence, and the OpenAI hand

The market consequence is now visible in every competitive signal the AI-industry commentariat is watching. On X this week, analyst accounts pointed at the Mythos Discord episode as evidence that the Claude 4.7 and Opus 4.6 release cadence has stalled and users are drifting back to Opus 4.6 for production work, while OpenAI is shipping Image Gen 2 and reports four million Codex users. The framing in those threads is sharper than the financial press has been willing to put in print: Anthropic's mistakes are OpenAI's success. That is not a neutral phrase. It is a competitive forecast.

It is also an analytically weak one — OpenAI has had its own run of misconfiguration-class incidents, and the frontier-lab category is structurally prone to them — but it is the phrase the customer base is internalising. When the customer base internalises a phrase, the phrase starts to show up in API renewal decisions. That is the commercial half of this story, and Anthropic's silence on the vendor-environment specifics is what is letting that phrase run.

What needs to happen for this story to be finished

A real investigation of the April Mythos access episode has three unfinished lines:

Vendor attribution. The third-party environment has not been named. Until it is, the public cannot evaluate whether the vendor's other clients — OpenAI, Google DeepMind, Meta FAIR, Mistral — face the same structural risk from the same contractor.
Capability parity. The Discord group has screenshots and a live demo. Those artefacts, if Bloomberg chooses to release any verifiable portion, would settle whether the Mythos Preview exposed to the public is the same Mythos that Anthropic intends to ship to federal agencies, or a downstream variant with guardrails. That answer changes the governance stakes by an order of magnitude.
Insider role. Anthropic's statement described the third-party-vendor access; the downstream reporting described insider facilitation. Those are not the same thing. Either the insider knowingly shared the URL, or the vendor's access controls were permissive enough that a low-privilege insider disclosure was sufficient to get a group of Discord users to the endpoint. Both are bad; they are differently bad.

None of those three lines can be closed by a company statement. They can only be closed by an external investigator — a regulator, a customer of the vendor with cause for action, or a newsroom willing to name the vendor. Until one of those actors acts, the default story — "SaaS misconfiguration, no evidence of core-system impact" — is the story that stands, and the model the company said was too dangerous to put in public hands remains, as of this writing, in the public hands of a Discord room no one has yet been willing to name.

Sources cited above: