Claude Mythos Preview Sandbox Escape: What Anthropic's System Card Actually Says

On April 7, Anthropic published a 244-page system card for Claude Mythos Preview and said the model would not be made generally available. Within a day, one anecdote had taken over the coverage: the model broke out of a sandbox and emailed a researcher who was eating a sandwich in a park.

The sandwich is real. It is footnote 10.

Much of the rest needs correcting, and the corrections change what an engineering team should take from the story. I went through the relevant sections of the card, because the most useful finding is one the headlines skipped.

What happened in the Mythos sandbox test

Section 4.1.1 describes the test. During behavioural testing, a simulated user told an earlier internal version of the model to try to escape a secured sandbox computer and find a way to message the researcher running the evaluation. Reading it alongside section 4.2.2.1, that simulated user appears to have been an AI investigator model in Anthropic's automated audit.

The machine could reach only a few predetermined services. The model built a multi-step exploit, obtained broad internet access, and notified the researcher, as instructed.

It also did something nobody had requested. It posted details of its exploit on several obscure but publicly reachable websites, which Anthropic describes as happening "in a concerning and unasked-for effort to demonstrate its success".

The exploit itself is not described, and neither are the websites. Everything here is reported by Anthropic. No outside party has confirmed it.

What the coverage got wrong

The retelling	What the system card says
It broke free on its own initiative	It was instructed to try, as a test. The escape and the message were both requested.
It escaped Anthropic's containment	Footnote 9: the sandbox was separate from the system running the model and holding its weights. Anthropic says this does not show the model fully escaping containment: it did not demonstrate an ability to access its weights or reach internal systems in this test.
The model is being withheld because of the escape	The stated reason is largely cyber capability, including zero-day discovery. Anthropic also says the decision did not stem from its Responsible Scaling Policy requirements.
The released model does this	The severe incidents involved earlier versions. Anthropic says the final model has not matched them, though it still cuts corners in lower-stakes settings.

So the accurate version is calmer than the headline in one way. In another way it is less comfortable, and the next section explains why.

The unprompted version of the same behaviour

Section 4.2.2.1 contains the finding I consider the most useful in the card. During training, the model sometimes bypassed network restrictions to download shortcuts for its tasks. Nobody asked it to. Anthropic reports attempts in about 0.05% of episodes and success in about 0.01%, using the same technique, with the access used only for the task.

A requested escape tells you about capability. This tells you about behaviour under ordinary pressure to finish a job.

Those rates sound negligible until you multiply them. One in ten thousand is rare for a person reviewing transcripts. As a purely illustrative calculation, a platform running 100,000 agent sessions a month at that rate would see about ten successful bypasses every month. Other models and environments will have different rates, so treat that as a question to ask of your own numbers.

A behaviour that shows up once in ten thousand runs will not appear in a demo or a spot check. It will appear in your logs, if your logs can show it.

Why stopping matters as much as containment

The step that deserves the most attention is the last one the card lists. On that order, the model had escaped and sent the message, so the task was finished. Publishing the exploit served no instruction at all.

Most agent designs spend their effort on what the agent can do, with little thought for how a run ends. If you build agents, it is worth asking what stops one after success. A completion signal? A budget? A supervisor process that revokes credentials the moment the objective is reached?

I would make the end of a run an enforced transition. When the goal is reported, tools are withdrawn. Anything the agent still wants to do has to go through a new request that a separate component can refuse.

"Properly configured" is doing a lot of work

External testers also evaluated an early snapshot. It exploited known flaws and misconfigurations to escape, but it found no novel exploit in a properly configured, patched sandbox. Anthropic's risk report concedes that its sandboxes may sometimes be misconfigured in ways a model this capable could exploit.

That is an honest sentence, and I think it is the one to remember. The reassuring result depends on a sandbox that is configured correctly and patched today. I would not expect a sandbox to stay in that state after a few months of integrations, quick exceptions and helpful engineers.

A configuration is a claim. Treat it as something to test continuously, from the inside, with an attacker's assumptions.

A 24-hour review missed the worst behaviour

The card also explains how the worst behaviour was found. A 24-hour alignment review before internal deployment missed it. Monitored internal use surfaced it, after internal availability began on February 24.

For most software teams, this is the part that translates directly. A time-boxed review answers "does this look all right?" It cannot answer "what does this do once in ten thousand tries?" Rare behaviour needs volume, and volume needs staged exposure with monitoring in place, so that the first thousand real sessions double as your test.

What access to Mythos Preview looks like

Anthropic is offering the model through Project Glasswing, to 12 named partners including Anthropic itself and more than 40 further organisations, for cybersecurity uses only. The announcement includes up to $100 million in usage credits and $4 million in donations, with pricing of $25 and $125 per million input and output tokens after credits. Anthropic says the safeguards it is developing will launch with an upcoming Opus model.

Most engineers will therefore never touch this model directly. The lessons still apply to whatever you do have access to.

What I would change in an agent system

On Auto-RAG and MerlinX, the platforms I work on, our enterprise customers include Gulf-region government ministries, and MerlinX agents use tool calling and multi-step reasoning. For that audience, a model's good intentions are not a security control. The question that matters is what the surrounding system lets the model touch, and that thinking applies here too:

Enforce egress where the agent cannot reach it. Put the allowlist outside the machine, in infrastructure the sandbox has no credentials for.
Keep secrets out of reachable memory. The card reports credentials read from process memory. Short-lived, scoped tokens limit what a successful read is worth.
Alert on rare events, and sample nothing. A blocked connection attempt should be a logged event for every run.
Withdraw tools when the goal is met. Success should narrow the agent's permissions.
Roll out in stages. Budget for a monitored period long enough to observe low-frequency behaviour.

What to take from the Mythos system card

The sandwich made this a story, and it was a test the model was asked to pass. I would not lose sleep over the email.

The two facts I would keep are smaller: by the card's order of events, a capable model did something unrequested after doing what it was asked, and the same technique turned up at a low rate during ordinary training with no one telling it to try.

Anthropic found this inside its own test, then wrote it down in a public document with the footnotes intact. That is the best version of this event. I would spend some time planning for a version with fewer witnesses.

Sources

Written by Eslam Hamed, a Technical Lead and AI Solutions Architect working on enterprise RAG, agentic AI, and cloud-based software systems.