Anthropic Leaked Its Most Powerful Model
A misconfigured data store at Anthropic left nearly 3,000 unpublished assets publicly searchable. Among them: a draft blog post describing Claude Mythos, a new model tier above Opus that the company calls "a step change" in capabilities.
Security researchers at LayerX and Cambridge found it. Fortune broke the story. Anthropic locked it down, but the details are out.
Mythos reportedly crushes current Opus models in coding, academic reasoning, and cybersecurity tasks. That last part is the problem. Anthropic's own draft says Mythos is "currently far ahead of any other AI model in cyber capabilities" and warns it "presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders."
The company is privately briefing government officials that large-scale cyberattacks become much more likely this year. That's a sobering thing to hear from the company that built the model.
For builders, the takeaway is practical. A new tier above Opus means more capability is coming to the API. But the security angle matters too. If you're shipping software, the bar for what counts as "good enough" security just went up. AI-assisted attacks aren't theoretical anymore.
Reddit Starts Labeling Bots Today
Starting today, March 31, Reddit rolls out mandatory bot labeling and human verification for suspected automated accounts. Legitimate bots get an "App" or "Developer Platform App" tag on their profiles. Accounts that look automated get challenged to prove they're human.
Verification methods include passkeys, Face ID, and even World ID. Reddit says this won't be a sitewide requirement. They're targeting accounts with suspicious activity patterns like posting too fast.
This matters if you build tools that interact with Reddit. Any automation you're running needs to be registered through r/redditdev or risk getting flagged. For the rest of us, it's a sign that platforms are getting serious about distinguishing humans from bots. Expect more of this everywhere.
LangChain and LangFlow Have Serious Security Flaws
Researchers disclosed three vulnerabilities in LangChain and LangGraph that can expose filesystem data, environment secrets, and conversation history. Separately, a critical flaw in the LangFlow AI platform is already under active attack, with threat actors exploiting it within hours of disclosure.
If you're using LangChain or LangFlow in production, patch now. These frameworks are popular for building LLM applications, and "popular" plus "unpatched" is exactly what attackers look for.
This is the unglamorous side of the AI tools boom. Everyone wants to ship AI features fast. Nobody wants to audit their dependency tree. But the attack surface for AI applications is growing just as fast as the capability surface. The GitGuardian report found 29 million new hardcoded secrets in 2025, up 34% year over year. That trend isn't slowing down.
What It All Adds Up To
The models are getting dramatically more powerful. The platforms are tightening their rules. And the security holes in AI tooling are real and being exploited right now. If you're building with AI, today's job is the same as yesterday's: ship useful things, but don't skip the boring parts. Patch your dependencies. Register your bots. And keep an eye on what's coming from Anthropic, because Mythos sounds like a big deal.