Even after the initial leaks, Anthropic themselves say they've improved on cybersecurity amount other things, giving the perspective (even if not 100% clear) that one of the focuses was vulnerabilities:

> In response to questions about the draft blog post, the company acknowledged training and testing a new model. “We’re developing a general purpose model with meaningful advances in reasoning, coding, and cybersecurity,” an Anthropic spokesperson said. - https://fortune.com/2026/03/26/anthropic-says-testing-mythos...

It is possible it is both, they used to RL against cybersecurity, but also didn't explicitly do any qualitative tests and added/changed more data because of those results. For Mythos, they stopped RL'ing against it, and also now intentionally try to make it better.

Unless of course they've actually noted exactly how things were trained here in some technical report and I've missed it, that's possible. Anthropic aren't famous for being very public about their internals though, but would be curious to read more details about it if it's out there from the horse's mouth.