I’m going to keep this practical: if you already ship with Anthropic models, the Project Glasswing launch is mostly a routing and configuration update, not a full-stack rebuild. The big change is choosing where Claude Mythos Preview should run, because this model is tuned for deeper security reasoning and can drive bigger tool usage, longer runs, and higher spend if you point everything at it by default.

My reaction to this post is simple: this is a capability launch wrapped in a deployment policy. Don’t treat it like a normal “new default model” announcement. Treat it like a high-impact model tier you deliberately route into security-heavy workflows.

Before you touch any tool: one model ID rule

Use the exact model identifier your account exposes, not a guessed string from social posts. In the snippets below, I use claude-mythos-preview as a readable stand-in. If your console shows a dated or provider-prefixed ID, copy that exact value everywhere. This is the #1 setup mistake and it causes silent fallback behavior that ruins testing.

Also keep a rollback target like claude-opus-4.6 so you can revert fast if latency, cost, or behavior shifts in production.

Claude Code

For Claude Code, the cleanest setup is to set Mythos as the model for security work while keeping your old default for general coding tasks. If you globally flip everything on day one, you’ll have a harder time isolating regressions.

{
  "model": "claude-mythos-preview",
  "fallbackModel": "claude-opus-4.6",
  "profiles": {
    "security-audit": {
      "model": "claude-mythos-preview",
      "maxTurns": 40
    },
    "general-dev": {
      "model": "claude-opus-4.6",
      "maxTurns": 20
    }
  }
}

Gotcha: increase timeout ceilings for long exploit-chain reasoning runs. Some teams think the model is failing when their local tool timeout is the actual bottleneck.

Cursor

In Cursor, the core change is selecting the new Anthropic model in your AI model picker and then updating project-level rules so sensitive code paths use the stronger model intentionally. Don’t rely on “last selected model” behavior for team workflows.

{
  "cursor.ai.defaultModel": "claude-opus-4.6",
  "cursor.ai.modelOverrides": {
    "security_review": "claude-mythos-preview",
    "dependency_audit": "claude-mythos-preview",
    "general_chat": "claude-opus-4.6"
  },
  "cursor.ai.maxOutputTokens": 8192
}

Gotcha: if your org has policy-managed model allowlists, the local setting can look correct but still fail at runtime. Confirm org policy and local config both include Mythos.

This second embed is where the technical credibility sits: benchmark movement and vulnerability workflow evidence are the reason to do any of this config work in the first place.

My takeaway: if your team does real AppSec, this is worth piloting now. If you don’t, keep Mythos scoped and avoid turning it into an expensive default for every autocomplete task.

Zed

Zed setups vary by whether you use built-in provider integrations or a custom API gateway. In both cases, the exact change is model selection plus per-assistant profile routing so you can isolate security workflows.

{
  "assistant": {
    "default_model": "claude-opus-4.6",
    "profiles": {
      "secure-code-review": {
        "provider": "anthropic",
        "model": "claude-mythos-preview"
      },
      "everyday-coding": {
        "provider": "anthropic",
        "model": "claude-opus-4.6"
      }
    }
  }
}

Gotcha: Zed users often forget to reload workspace settings after editing JSON, then assume the new model is active. Verify with one prompt that echoes active model metadata before testing quality.

Anthropic API

For direct API users, the exact change is in the model field, plus optional routing logic in your app layer. Keep your previous model in config so rollback is one env var change, not a code patch.

{
  "model": "claude-mythos-preview",
  "max_tokens": 4096,
  "temperature": 0.2,
  "metadata": {
    "route": "security_pipeline_v1"
  }
}

Recommended env layout:

ANTHROPIC_MODEL_SECURITY=claude-mythos-preview
ANTHROPIC_MODEL_DEFAULT=claude-opus-4.6
ANTHROPIC_MODEL_ROLLBACK=claude-opus-4.6

Gotcha: Mythos-class workflows can consume more tokens due to deeper reasoning loops. Track cost per validated finding, not cost per API call.

AWS Bedrock

On Bedrock, you typically reference the provider’s model ID format in your invoke payload. Exact string varies by region and release channel, so copy directly from the Bedrock model catalog in your account.

{
  "modelId": "anthropic.claude-mythos-preview-v1:0",
  "contentType": "application/json",
  "accept": "application/json",
  "body": {
    "anthropic_version": "bedrock-2023-05-31",
    "max_tokens": 4096,
    "messages": [
      {"role": "user", "content": "Run a focused security review of this diff."}
    ]
  }
}

Gotcha: teams often update code but forget IAM permissions and regional model access. If invocation fails, check access grants and region availability before debugging payload structure.

This third embed belongs right before cloud-provider rollout advice, because it reinforces that this model class should be deployed with controlled access and explicit defensive intent.

My reaction: the smart rollout pattern is limited lanes, strong audit logs, and human validation gates. Faster vuln discovery is only good if your patch process can absorb it.

Google Vertex AI

In Vertex, the exact change is selecting the Anthropic partner model name available in your project and region, then pinning it in your generation config. Again, use the literal model resource name shown in your console.

{
  "model": "publishers/anthropic/models/claude-mythos-preview",
  "parameters": {
    "maxOutputTokens": 4096,
    "temperature": 0.2
  },
  "safetySettings": [],
  "instances": [
    {"messages": [{"author": "user", "content": "Analyze this service for exploit paths."}]}
  ]
}

Gotcha: partner-model naming and availability can differ by region, and old deployment templates may still point to your previous model even after UI changes.

Cost impact and when not to upgrade yet

Even with similar list pricing, real spend can rise because Mythos-style tasks run longer and call tools more often. Add per-route budgets and hard caps before rollout.

{
  "routing": {
    "security_critical": "claude-mythos-preview",
    "default": "claude-opus-4.6"
  },
  "limits": {
    "daily_token_cap": 2500000,
    "per_task_token_cap": 120000
  }
}

Do not upgrade yet if you lack reproducible evals, don’t have triage staffing, or can’t enforce strict tool permissions. In that scenario, you’ll increase output volume without increasing trust or remediation speed.

I like this final embed as context: multiple labs are signaling the same trendline in cyber-capable models, so the winning move is operational discipline, not tool tourism.

Bottom line: wire Mythos into the workflows where it has clear edge, keep rollback live, measure cost per useful security outcome, and resist the urge to make it your universal default on day one.

Now you know more than 99% of people. — Sara Plaintext