Anthropic’s Mythos model uncovers 10,000+ critical software bugs in one month

The bug hunting floodgates open

For decades, cybersecurity ran on an obvious assumption: zero-day vulnerabilities were rare, precious, and painfully slow for humans to uncover.

Anthropic just proved that era is officially over. A month after launching Project Glasswing, an initiative aimed at hardening critical digital infrastructure, the company shared initial results from testing its preview model, Claude Mythos Preview. Alongside roughly 50 enterprise partners, the model has uncovered over 10,000 high- or critical-severity vulnerabilities in core production software.

The findings are absurdly lopsided. Cloudflare alone discovered 2,000 bugs across its mission-critical systems, with 400 rated high or critical severity. Even wilder, Cloudflare reported the model achieved a false positive rate superior to human security testers. Mozilla tested Mythos Preview on Firefox 150 and fixed 271 flaws, a tenfold leap over what Claude Opus 4.6 flagged in Firefox 148.

Palo Alto Networks shipped five times more patches than usual in its latest cycle, while Oracle and Microsoft are both bracing for elevated disclosure rates for the foreseeable future. Outside pure software bugs, Mythos even helped a partner bank stop an active 1.5 million dollar fraudulent wire transfer triggered by account takeover and spoofed calls.

Open source is buckling under the weight

Turning an automated super-scanner loose on commercial software is one thing. Pointing it at open source, where maintainers are unpaid and chronically exhausted, is an entirely different operational crisis.

Anthropic used Mythos Preview to inspect over 1,000 foundational open-source projects, surfacing 23,019 potential issues, including 6,202 estimated as high or critical severity. When independent security research firms audited a sample of 1,752 of those top-tier alerts, 90.6 percent were confirmed as genuine bugs, and 62.4 percent were verified as genuinely high or critical.

Among the discoveries was CVE-2026-5194 in wolfSSL, an embedded cryptographic library deployed across billions of devices. Mythos built a working exploit capable of forging digital certificates, letting an attacker spin up indistinguishable counterfeit sites for banks or email services.

Yet the bottleneck has violently flipped. Of 530 critical or high-severity flaws officially disclosed to maintainers so far, only 75 have been patched, averaging two weeks of human effort per fix. Several maintainers have explicitly begged Anthropic to slow down, paralyzed by a backlog of AI-surfaced vulnerabilities they lack the engineering hours to patch.

Why it matters

We think this update exposes the most dangerous structural asymmetry in AI today. Finding vulnerabilities has effectively collapsed toward zero marginal cost, but reviewing, writing, and rolling out reliable patches remains entirely bound by human hands.

For defenders and open-source stewards, this creates immediate friction. Maintainers are already burnt out from spammy automated bug alerts, and even high-precision reports from Mythos create a massive queue of legitimate critical work. Until frontier models can autonomously write, test, and safely commit verified patches without breaking legacy code, defenders will be drowning in fire alarms.

More importantly, the offensive clock is ticking. Anthropic is operating under responsible disclosure, coordinating through 90-day embargoes with trusted partners. But Mythos-class reasoning will not stay inside Anthropic's walled garden indefinitely. The second unaligned or rival actors gain access to comparable cyber capabilities, they will not wait two weeks for a maintainer to draft a fix. They will simply pull the trigger on thousands of automated exploits at machine speed.