Mythos Leak - Headless CMS Draft Exposure

The real Mythos leak, March 2026

In March 2026, Fortune reported that a major AI lab had accidentally exposed thousands of unpublished assets through its headless CMS. Among them was a draft post announcing an unreleased frontier model. Two security researchers, Roy Paz of LayerX and Alexandre Pauwels of the University of Cambridge, found it. The whole incident came down to one configuration mistake on a real-world platform that powers a lot of marketing sites you have visited.

You are the researcher

This lab drops you into the same starting position Roy and Alexandre had: a marketing page, a hunch, and a single curl session. You bring the curiosity. The lab brings a faithful reproduction of the same misconfiguration, on the same platform, with the same API shapes - down to the error responses you would see if you probed the real service today.

Going further than the public report

The first stage of this lab is a faithful replay of the incident. The second stage pushes past it: there is something the team thought they had locked away, and the same misconfiguration that exposed the draft also makes it reachable if you look in the right place. Practicing the full chain hands-on is the fastest way to build the instinct for spotting the same pattern on a real engagement.