Why the best AI model isn't for sale

~ $ curl -X POST api.anthropic.com/v1/mythos
────────────────────────────────────────────
HTTP/2  403  Forbidden

  ✗ model 'mythos' is not for sale
    access → project-glasswing (restricted)

# official reason: too dangerous
# follow the money for the second story

In April, Anthropic shipped a security model called Mythos that, by its own announcement, autonomously found working exploits for thousands of zero-days. Then it did the strange thing: it didn’t sell it. No public API, no line on the pricing page — access gated behind a vetted consortium called Project Glasswing. The official reason is that the thing is too dangerous to hand out. That’s a real argument, and worth taking seriously. It is also not the only story the incentives tell.

The model you’re not allowed to buy

Mythos landed on April 7, 2026. The capability claim was specific and loud: comb a codebase, surface real exploitable vulnerabilities, at a scale no human team matches. The distribution decision was just as specific — restricted access, vetted partners, the Glasswing consortium instead of a checkout button.

The stated reason is safety, and it deserves a fair hearing. A model that finds offensive cyber capability faster than defenders can patch is genuinely dual-use, and “we are not going to put this on a public API” is a defensible call. Anthropic has also signaled (The Register, May 25, 2026) that Mythos-class models may reach the public eventually — which is roughly what you’d expect if danger, not economics, were the only gate.

And to be clear about the tool itself: this generation of AI code analyzers is genuinely better than what came before. Daniel Stenberg, who maintains curl and has no reason to flatter anyone, says so plainly. So this is not an “AI is fake” piece. It’s a “watch where the money goes” piece — and the money goes somewhere interesting.

Follow the money

Here’s the part the safety story leaves out. Frontier inference is sold below what it costs to serve, and has been for a while: the familiar land-grab move — price under cost, take the market, sort out the unit economics later. The numbers that leak out aren’t subtle. Sam Altman has said the $200/month ChatGPT Pro tier loses money because people “use it much more than we expected.” Deutsche Bank expects OpenAI to run some $143 billion of negative cumulative cash flow through 2029 before it turns a profit. Nvidia’s Bryan Catanzaro put it most bluntly: the cost of compute is “far beyond the costs of the employees.”

That floor is now lifting. In April 2026, Anthropic switched Enterprise billing to the compute customers actually use, dropping the old flat rate. GitHub moved Copilot to usage-based pricing on June 1. The subsidy that made 2025 feel cheap is being switched off, line by line.

Now put Mythos back in the frame. A model that “autonomously finds exploits for thousands of zero-days” is, by construction, a heavy-compute model — long agentic runs, lots of tokens, exactly the workload that loses the most money per user. A mass-market Mythos would be a furnace you’d have to feed at a loss for everyone who used it seriously. A restricted halo model costs almost nothing to keep behind glass and — we’ll get to this — is worth more there. The safety framing and the economics happen to point the same direction. That’s the second story: not a secret “real” reason, just the one the incentives quietly underwrite.

The 80/20 problem (why it’s worth less than it’s sold as)

There’s a second reason a money-furnace would be a bad trade: the product is worth less than the demo suggests.

AI gets you to eighty percent fast. The last twenty — the auditing, the silent omissions, the thing it confidently did not do — is where the cost hides, and that cost can exceed doing the work yourself. METR’s study of experienced developers found them about 19% slower with AI assistance while believing they were faster. Feeling faster and being faster came apart. That gap is the whole problem in one sentence.

Stenberg’s curl experiment is the same lesson at maintainer scale. Mythos reported five “confirmed” vulnerabilities in curl. One survived contact with a real maintainer, and it was low-severity. His verdict on the exercise: “primarily marketing.” Four of five reports were work he had to do — triage, reproduce, dismiss — before getting back to the one small real finding. The first eighty percent looked spectacular. The last twenty was his afternoon.

To be fair to Mythos, the broader numbers beat that one curl run. Of the high- and critical-rated open-source bugs Glasswing sent to validation, 90.6% proved real (1,587 of 1,752). This is not a false-positive machine. But “valid” and “worth fixing now” are different tests. A real-but-low-severity or already-mitigated bug still lands on a maintainer’s desk as work: triage, reproduce, decide it can wait. The validity rate is high; the value rate is the one Stenberg actually had to pay — and value is the column that costs you.

The demo is the first 80%. The bill is the last 20%.

You’re paying for the publicity

So if the best model loses money at scale and underdelivers on the last mile, why ship it at all? Because in this market, “we have the best model” is itself the product.

The buyers are not, mostly, buying utility. PwC’s 2026 survey of CEOs found 56% reporting no measurable financial return from their AI spend. A separate survey of executives by WRITER and Workplace Intelligence put numbers on the mood: 75% said their company’s AI strategy is “more for show” than real guidance, and 48% called adoption a flat disappointment. That’s a FOMO market, and in a FOMO market a deliberately-restricted frontier model is a marketing asset before it is a product. It generates the headlines, anchors the brand at the frontier, and hands enterprise buyers a story to tell their boards — all without the provider eating the compute bill of mass adoption.

A halo model you can’t buy is cheaper to run, harder to falsify, and better PR than a product people would actually use and then measure. The restriction isn’t only caution. It’s also the most efficient form the asset can take.

So what should an engineer actually conclude?

Not “AI is fake.” The tools are real and, in the right hands, genuinely good. The conclusion is narrower and more useful.

Separate the tool from the halo. The model that finds a real bug in your codebase and the model held up as too dangerous to sell are marketed together on purpose. They are not the same purchase.

Expect the prices you see today to rise. The subsidy is ending on a published schedule — Enterprise metered in April, Copilot usage-based in June. Budget for the un-subsidized number, not the land-grab one.

Judge tools on the last twenty percent. The demo is free and the first eighty percent is easy. Ask what it costs to audit the rest. That’s the real price, and it’s the one nobody puts on the slide.

Follow the money, and the model you’re not allowed to buy starts to make sense — not as a thing too powerful to sell, but as a thing worth more unsold.