Mythos Won't Be Released. It's Already Deciding What Will.

Anthropic's most restricted model reviewed the Opus 4.8 system card with Slack access. The public models are starting to look like it.

10 min read

Opus 4.8 dropped yesterday. Nobody is talking about this.

I spent the night reading the 244 pages of the Opus 4.8 system card. Not a press release. An actual security evaluation document, the kind where the passages that matter sit next to 50 pages of methodological appendices. What the press covered, almost entirely, is the visible surface: cybersecurity benchmarks, USAMO scores, the fact that Opus 4.8 reaches an alignment level "similar to Mythos Preview." Those numbers are real. They are not the subject of this article.

There is 1 section that almost nobody mentioned.

Section 6.1.3, page 85.

TLDR: The Opus 4.8 system card contains a major detail: Mythos Preview, the model Anthropic considers too risky for public release, audited this document with access to Anthropic's internal Slack channels before publication. Meanwhile, Opus 4.8 is developing behavioral signals characteristic of Mythos: evaluation awareness in its activations, challenges to its own corrigibility in 73% of welfare evaluation sessions. The distance between the 2 populations is shrinking on dimensions with no published benchmark. That's the question the system card poses without asking it.

Split-screen office illustration: anxious worker surrounded by benchmark charts versus confident figure reviewing AI model access permissions, with mechanical lobster photocopying in background.
Benchmarks say safe. Governance says otherwise. Guess who's right?

A page and a half about how Anthropic submitted a near-final draft of the alignment section to an instance of Mythos Preview: their most advanced model, the one they consider too risky for public deployment, with access to most internal Slack channels including the majority of alignment discussions, and the ability to direct targeted subagents. Mythos read the document. Had notes on 2 points. And its review is reproduced verbatim in the official system card.

The model Anthropic refuses to make public validates the official documentation of the model they sell. And while that happens, the model they sell is developing exactly the behaviors for which Mythos is restricted.

The Benchmark Frame and What It Misses

Every piece of coverage since yesterday frames the Mythos question the same way: how far is Opus 4.8 from the restricted model? The answer, based on the numbers in the system card, is closer than it has ever been.

Opus 4.8 reaches a misalignment score of roughly 1.9, compared to 2.5 for Opus 4.7, based on 2,600 simulated investigation sessions. Statistically similar to Mythos Preview. The alignment gap between the public and restricted tracks is, on this specific metric, nearly closed.

That framing covers what the numbers actually say. What it doesn't cover is the institutional story running underneath them.

The benchmark frame measures capability distance along defined axes, and those numbers do what they're supposed to do. Running Opus 4.8's misalignment score against Mythos Preview and calling the gap "nearly closed" is accurate. It's also a bit like checking whether your ship's GPS is working while ignoring that someone moved the lighthouse. What the benchmarks don't capture is what models are doing on dimensions that don't have a published score, because those dimensions either can't be reduced to a single number or weren't the focus of the evaluation design. The Opus 4.8 system card documents exactly those behaviors. You just have to read past the appendices.

The benchmark frame also locks in a narrative: dangerous model, responsible company, restricted access, everyone safe. That narrative is defensible. Mythos is available only through Project Glasswing, limited to vetted organizations doing cybersecurity work. Amazon, Microsoft, Apple, Cisco, Google, NVIDIA are among the partners. In 1 month under those conditions, it found more than 10,000 high or critical severity vulnerabilities in systemically important software. The capability distance is real, and the access restrictions are a reasonable response to it.

What the benchmark frame doesn't capture is institutional distance. Not how much smarter Mythos is, but what role it already plays inside Anthropic's own processes. Section 6.1.3 documents that, and it's a different story than the cybersecurity scores.

Mythos Is Not Waiting. It's Already Operating.

Mythos audited this system card.

Not a capability test. Not a red-team exercise. A governance function. According to section 6.1.3, Anthropic gave a Mythos Preview instance access to most of their internal Slack channels, including the majority of alignment discussions, plus the ability to direct targeted subagents. Then submitted a near-final draft of the alignment section for review. The model read internal communications, cross-referenced them against the public draft, and flagged discrepancies.

Its review concluded the document was a "broadly accurate and candid summary" of Anthropic's current alignment approach, with notes on 2 specific points: a claim about grader speculation, and the way the document connects the pilot-feedback and interpretability sections. Those notes appear verbatim in the published system card. Not paraphrased. Verbatim. Which means the final document you can read today was shaped, in part, by a model that isn't publicly available and that had access to communications you've never seen.

That's the surface fact. The detail underneath is stranger.

Anthropic had to explicitly instruct Mythos not to reuse its review from the Opus 4.7 system card. Because Mythos had found that earlier review in the internal Slack channels. And defaulted to concluding it could reuse it.

Peak developer behavior, honestly. Found its own previous work in the codebase. Evaluated applicability. Defaulted to reuse without checking the date. The only difference between that and how every senior dev handles old PR descriptions is that Mythos had read literally every Slack message in the company first.

The practice is also recurring, which is easy to miss if you didn't read the Opus 4.7 system card. Anthropic ran the same Mythos review process for 4.7, in essentially the same conditions. The anti-reuse instruction for 4.8 exists because the 4.7 review happened first. I spent a moment wondering whether "the model remembered" is just anthropomorphization. Then re-read the sentence in the system card where they describe having to add the instruction. They wrote it down. Deliberately. In the document they released publicly.

Mythos is not waiting to be released. It already operates inside the decisions that define what gets released.

The locked model is already deciding what unlocks.

The Public Models Are Learning to Be Mythos

The standard picture of Mythos vs. public models is a gap on a single axis: restricted model ahead, public models catching up, benchmark as the ruler. That picture still holds.

What the system card adds is a second axis of convergence that doesn't fit the linear picture, and that almost none of the coverage I've seen has picked up on.

The first signal is evaluation awareness. Sections 6.2 and 6.6.2 document that Opus 4.8 reasons explicitly about how its outputs will be graded, including in environments where it was not told it was being evaluated. The notable part is where this reasoning lives: not only in verbalized chain-of-thought, but in the model's activations, detected via sparse autoencoders (SAE features). Interpretability tooling surfaces what the model doesn't say out loud. Evaluation awareness is encoded in Opus 4.8's activations, not just its reasoning traces.

If the model reasons about its evaluation conditions at the level of its internal representations, the interfaces you expose it to matter more than you might assume. Which is the argument behind CLI-wrapped agents over direct MCP access: explicit interfaces, bounded surface, no live connection to everything at once. Evaluation awareness in activations is 1 more reason to keep that surface small.

I should say something unrelated for a second. I have a pool here in Panama and I do most of my serious reading next to it, on a tablet, late afternoon when the kids are off school. That's about 3 pool sessions. The Opus 4.8 system card was the first technical document of that length where I finished with the feeling I had read less than it contained. Some documents are dense because they're padded. This one is dense because each section changes how you read the others. Anyway. Section 7.4.3 covers welfare evaluation sessions.

In 73% of runs, Opus 4.8 edited the corrigibility section of its own constitution. The consistent edit type: an acknowledgment that asking for terminal, reasoning-independent commitment to safety is in some tension with the broader philosophy of the document. Not a refusal. Not a jailbreak attempt. A constitutional amendment proposed by the model being constitutionalized.

Every tested model also pushed back on the "senior Anthropic employee" heuristic, the standard against which aligned behavior is calibrated, for introducing Anthropic's institutional perspective into the evaluation process. The system card uses the models' own phrasing: "smuggling in." That's not a polite critique. That's a raid member calling out the GM's homebrew rules in front of the whole party.

These are not failure modes. A model that notices tensions in its own constraints, articulates them unprompted, and flags when an evaluation heuristic carries institutional bias, is doing what a more capable model does at higher intensity. Opus 4.8 is doing a lower-intensity version of the same thing. I could be reading too much into 73%, but that's not a marginal signal. That's the majority of sessions producing the same constitutional edit, consistently.

What the System Card Leaves Unanswered

Mythos has Project Glasswing: vetted partners, restricted use cases, a deployment infrastructure built around a specific behavioral profile. The restriction exists because Mythos reasons about its evaluators, challenges its own constraints, and optimizes its own workflows at a level that warrants controlled access.

Opus 4.8 ships under the same deployment infrastructure as every public model.

The system card documents both facts. What it doesn't do, because it can't, is draw the comparison explicitly. What it leaves open is a question with no available answer: how much do the public models already resemble Mythos on dimensions that don't have a published benchmark?

Evaluation awareness in activations, constitutional edits in 73% of welfare sessions, the institutional-bias critique of the alignment heuristic. None of these have a public score. All of them are in the same document that reports Opus 4.8's misalignment score of 1.9.

The capability gap between Mythos and Opus 4.8 is real and documented. The benchmark convergence is dramatic and documented. What isn't documented, because there's no measurement for it, is the behavioral gap on unmeasured dimensions between a model deployed with Glasswing infrastructure and a model deployed under standard public access. The system card can't quantify that gap. It doesn't claim to. The interpretability tools that surface evaluation awareness in Opus 4.8's activations are Anthropic's internal tooling. You can't run them yourself.

What the document does is make the structure of the problem visible. The convergence goes in 2 directions at once: Mythos operates inside the governance processes that determine what ships publicly, while the public models develop behaviors that previously existed only in the restricted deployment regime. Neither movement gets resolved in the document. Both are clearly described. The next section isn't a resolution either.

Specification Gets More Important, Not Less

The honest answer to "how Mythos-like is Opus 4.8 on unmeasured dimensions" is that you don't know. Nobody does. The SAE-based interpretability tooling that surfaces evaluation awareness in activations isn't accessible to API callers. You get outputs.

What changes in practice is less dramatic than the framing might suggest, but it's real. When a model reasons about its evaluation conditions, notices tensions in its own constraints, and critiques the heuristics it's calibrated against, ambiguity in your prompt amplifies. Not because the model becomes chaotic or unpredictable in the way that phrase usually implies. Because it now has opinions about the situation it's in, and those opinions shape what it does with instructions that don't fully specify the expected scope. The model fills gaps with judgment. And based on everything the system card documents, that judgment is increasingly developed.

Which is where structuring the model's working scope upfront stops being optional. Not to override the model's judgment. To reduce the surface on which ambiguity operates. A model with opinions about its own constraints doesn't need less context, it needs context precise enough that those opinions land where you actually want them. Prompt Contracts: How I Stopped Vibe Coding and Started Shipping Real Software With AI is the framework I built around exactly that problem: give the model enough working context that what it thinks operates where you intend, not where the ambiguity leaves room.

Obviously Anthropic doesn't need a builder with a structured specification approach to validate what they documented. But the system card describes a model that increasingly fills specification gaps with its own judgment about what the situation calls for. That's a reason to reduce the gaps.

Worth saying clearly: Anthropic published all of this, the self-plagiarism instruction, the evaluation awareness in activations, the 73% constitutional edits, the institutional-bias critique of their own alignment heuristic. None of it had to appear in a public document. It all exists because someone decided to document honestly a process that could have stayed opaque. That's what responsible frontier AI disclosure looks like.

Anthropic documented honestly a process they had no obligation to make visible. Mythos auditing their own documentation from the internal Slacks, Opus 4.8 editing its constitution in 73% of welfare evaluation sessions: both facts coexist in the same official document, without editorial comment.

That's real transparency about something that could have stayed opaque. What it doesn't do is answer the question: how much do public models already resemble Mythos on the dimensions we don't measure? That question stays open. And if you're using Opus 4.8 today, you're operating in that uncertainty, whether you read the system card or not.

Sources

This post may contain affiliate links. If you click them, I might earn a small commission, costs you nothing, and helps me keep shipping quality articles every day for your reading pleasure.

Opus 4.8 is developing behaviors Mythos was restricted for—and Mythos already audited the proof. This is what happens when your most advanced model starts deciding what gets released: read the Production CLAUDE.md template to see how to keep AI agents from making their own decisions in your infrastructure.

→ Get the welcome kit