Claude Mythos Preview Uncovers 10,000+ High-Risk Vulnerabilities, Exposing Critical Patching Bottleneck

Summary

Anthropic announced that 50 cybersecurity and infrastructure partners using Claude Mythos Preview, an unreleased model, have discovered over 10,000 high- and critical-severity vulnerabilities in critical software systems through Project Glasswing, a security initiative launched last month. The findings represent a tenfold jump in bug-detection rates for most participating organizations, with partners like Cloudflare discovering 2,000 bugs—including 400 high or critical-severity flaws—within weeks. Anthropic also scanned over 1,000 open-source projects and identified an estimated 23,019 vulnerabilities, of which 90.6% were validated as true positives in independent review.

However, the dramatic acceleration in vulnerability discovery has created an unprecedented bottleneck in the cybersecurity supply chain. Anthropic reported that severe bugs identified by Mythos Preview take an average of two weeks to patch, and some open-source maintainers have requested that the company slow its vulnerability disclosures due to limited resources. The company emphasized that the pace of software security has fundamentally shifted: "Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch" the growing number of flaws. Despite these capabilities, Anthropic is withholding public release of Mythos-class models, citing inadequate safeguards against misuse.

• Independent validation shows 90.6% accuracy on reviewed vulnerabilities, confirming Mythos Preview's low false-positive rate and reliability for security teams
• Anthropic is delaying public release of Mythos-class models, citing insufficient safeguards against potential misuse despite demonstrated cybersecurity benefits

Editorial Opinion

This is a watershed moment for AI-assisted cybersecurity, but it reveals a structural vulnerability in how the industry scales security responses. When an AI model can find bugs 10 times faster than human testers—with minimal false positives—but organizations struggle to patch them in weeks, the bottleneck has fundamentally shifted from discovery to remediation. Anthropic's decision to withhold public release is prudent: releasing such a powerful tool without adequate safeguards could create a security crisis where well-resourced attackers use AI to find zero-days faster than maintainers can fix them. This finding underscores that the future of AI security lies not just in building better detection tools, but in rethinking how the entire software supply chain coordinates disclosure, patching, and deployment.