By Barry Meng — 23 May 2026

Cyber Selloff: No Market Leak

On 7 April 2026, Anthropic announced Claude Mythos Preview, its cybersecurity-focused model, and Project Glasswing, its partnership program to use Mythos to improve defensive cybersecurity capabilities. The firm stated that this model was capable of diagnosing cybersecurities risks far beyond human ability. Their frontier model, Claude Mythos Preview, was too dangerous to hand out to ordinary citizens, where it could be used by nefarious actors to carry out ill intent. Cybersecurity breaches break the news often, but Mythos Preview would be a serrated dagger through skin, revealing the inner guts of any private firm: data.

AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities. - Anthropic

My prediction was that cybersecurity firms would be punished by the market, whereas Glasswing partners would be rewarded and their stock price rebound. This thesis is borne out by the data, but the extent is larger than expected. I found that cybersecurity firms were affected, but mega-cap partners barely moved at all.

There are two main events to keep in mind, the Fortune leak in late March, and the official announcement by Anthropic on 7th of April.

The Motive

If markets had been pricing in Mythos before April 7, the cyber stocks should have drifted down in the days leading up to the announcement, and especially after the Fortune leak hit the wires at 22:27 ET on March 26.

It wasn't.

Median cumulative AR by group (FF5+UMD factor model, re-zeroed at τ = −30) for three groups across the [−30, +10] window around April 7. Glasswing cyber partners (CRWD, PANW) in red; Glasswing mega-cap partners (MSFT, GOOGL, CSCO, JPM, AMZN) in green; the 11 non-Glasswing pure-play cyber peers in blue. Shaded bands are the 25th–75th percentile range within each group. The Fortune-leak window (τ ≈ −7 to −6) is shaded orange; the Mythos announcement at τ = 0 is the vertical black line.

The within-cyber Glasswing premium documented later shows a post-announcement cushion. Partners were up roughly the same amount as non-partners going in, and just sold off considerably less coming out. This indicates that cybersecurity firms, regardless of positioning, were battered by the market post-announcement. The mega-cap Glasswing partners barely moved at all, which shows a divergence in the exposure to market, a surprising result.

Mythos came as a genuine surprise to the cyber market. No information leakage is apparent in the data series. All the cyber-specific reaction landed in the trading days after the official announcement.

Comparing the industries, the software control dropped more than the cyber panel, which may mean that AI-narrative software stocks drop on AI capability events, while non-AI software and defensive sectors don't. AI directly substitutes cybersecurity labour.

Event-time mean CAR (FF5+UMD market model, 250-day estimation window ending 30 days before each event) across the 28-event sample, by firm panel. Lines show the per-panel mean across firm-event cells; shaded bands are 95% pointwise confidence intervals. Treatment cyber and software controls fall in tandem post-event; legacy SaaS and defensive ETFs sit flat near zero.

The Tail Event

Mythos was an extreme event, in the bottom 0.1 percentile of all cyber events. Of all 200 random trading days in 2024-2025, the post-announcement drop was a rock off a cliff, an enormous statistical anomaly.

Histogram of treatment-cyber panel mean CAR at the [-2, +2] window across 200 random trading days (Jan 2024 – Oct 2025, ±5-day buffer around real events). Vertical lines mark each Tier-1 anchor; the empirical two-sided p-value sits next to each label. The 5th and 95th percentiles of the placebo distribution are at -5.32% and +3.88%; T1-Mythos sits at -8.25%, in the bottom 0.1 percentile.

Statistically the post-Mythos days were some of the worst trading days for cyber in recent history. What about for the Mythos partners?

The Glasswing Partner Premium

Anthropic's Project Glasswing partner page lists Cisco, AWS, CrowdStrike, the Linux Foundation, JPMorgan Chase, Google, Palo Alto Networks, and Microsoft. Of those, the public equities I could include (CRWD, PANW, MSFT, GOOGL, CSCO, JPM, AMZN) formed a natural cross-sectional test.

Within the pure-play cyber peer group (CRWD + PANW vs the other 11 cyber firms), Glasswing partners outperformed non-partners by a statistically significant amount of 2.86% across the windows, compared to other general AI model drops. Glasswing partners earned a positive premium on the events where partnership salience was highest, and roughly nothing on the rest.

Glasswing partners did not outperform non-partners going into the announcement. They outperformed coming out.

What would change my mind

Two threads are unfinished.

OptionMetrics for 2025-Q4 and 2026 doesn't land on WRDS until late June 2026. That means the H2 options-market lead-lag test is uncomputable at the Tier-1 windows that matter. The real question is whether skew widened into Mythos on April 6-7, into the Fortune leak on March 26 evening, into the Cowork launch the morning of January 30. If skew lead-up shows up cleanly inside Tier-1 windows when I re-run in July, that's a JFE-tier finding and I'll do the working paper version.

Capability-delta scoring for Stage 4 is provisional. The pre-reg cites AISI / METR / Bishop Fox / CETaS reports as the proper external source for the [-1, +1] capability uplift scores driving the matched pairs. I coded the scores myself from event descriptions; the H4 reversal could shift with proper external coding. I think the direction would survive but the magnitude could halve.

Conclusions

AI capability shocks measurably move US cybersecurity equities, and the per-ticker price action shows no anticipatory selling before either the Fortune leak or the announcement, meaning Mythos was a genuine surprise. But the move isn't cyber-specific: it's AI-narrative software multiple compression with cyber as one component.

If Anthropic can provide the armour to these companies, and their stock prices are rewarded, that leaves all the serfs open to the pillaging of raiders and barbarians. Without a gate to the keep the barbarians out, the landscape of offensive security may soon change to favour those pillagers.