Claude Mythos: AI finds flaws faster than we can patch them

On October 14, 2026, Bank of America's CEO Brian Moynihan gave the first precise measure of the effort. To fix the software flaws uncovered by Claude Mythos, Anthropic's AI, and by other models, the bank brought in about 1,000 contractors. They work alongside the roughly 3,000 people who were already on the job.

Since April, AI systems have been finding vulnerabilities by the tens of thousands, in companies' own code and in the open source software everyone depends on. Teams can no longer keep up: every flaw has to be fixed, and every fix installed before an attacker uses it. That window is now measured in hours.

For a company, this changes two things. Security updates become an emergency, handled within the day instead of waiting for the next monthly cycle. And the self-hosting question looks different:

Running open source software on your own servers is still possible, provided you can patch it in a day, not a month.

What is Claude Mythos?

Claude Mythos is Anthropic's cybersecurity AI: a model that can find and exploit unknown security flaws on its own. Anthropic unveiled it on April 7, 2026 as Claude Mythos Preview. According to the company, it finds zero-day vulnerabilities, unknown to the vendor, "in every major operating system and every major web browser". In a test on Firefox's JavaScript engine, without the browser sandbox, Mythos produced 181 working exploits. The previous model, Opus 4.6, managed two out of several hundred attempts.

Anthropic judged the model too dangerous for broad release. It kept it for Project Glasswing, a defensive program launched with eleven partners: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. More than forty unnamed organizations joined at launch, then about 150 more in June. Anthropic put up as much as $100 million in usage credits and $4 million in donations to open source foundations.

Two versions have followed: Mythos 5 in June and Mythos 5.1 in September. In June, the US government briefly suspended their distribution before reopening it. In September, Anthropic still wrote that Mythos 5.1 was only available to "a set of US organizations". Since October 6, its Cyber Verification Program has opened it to vetted organizations and researchers, with no stated geographic criterion, in partnership with the US government. We come back to this below: access remains a real issue for Europe.

Mythos is not alone. OpenAI offers GPT-5.5-Cyber and Codex Security to vetted partners, Google has Big Sleep and CodeMender, and companies such as AISLE also find flaws at scale. Mythos gets the most attention, and most of the published figures are about it.

What the wave of flaws cost the first organizations hit

Mozilla: more flaws in one month than in a year

Mozilla, which develops Firefox, started working with Anthropic in February. On April 21, Firefox 150 fixed 271 flaws found by an early version of Mythos. Over the month of April, Mozilla fixed 423 security bugs from all sources. In 2025, it fixed 20 to 30 a month, or 258 over the year based on its monthly figures. More than a hundred people contributed fixes.

Sylvestre Ledru, Mozilla's director of engineering, described that period from the inside on the French tech show Underscore_ (in French). Firefox usually received "about twenty new vulnerabilities a month". In March and April, "in one month we fixed more security flaws than in a year". Before 2026, he would have guessed Firefox's latent flaws at "50, maybe 60". He talks about "an order of magnitude".

Two details of his account matter for any company. First, Mozilla coped because its fuzzing engineers (fuzzing is automated testing with random inputs) already had the infrastructure to absorb the flow: "luckily, otherwise I think we would have burned out". Second, he does not see the wave receding any time soon:

He expects "between one and two years" of "disaster in software" while everyone catches up.

Managers at large companies tell him that pushing an update within a few hours is "unthinkable" for them.

Bank of America, JPMorgan: hundreds of people working full time

US banks were among the first to test Mythos, at the urging of the authorities, after the Treasury and the Federal Reserve summoned their CEOs in early April. Bank of America has now put a number on the effort: about 1,000 contractors, and "a couple hundred million dollars plus" for the quarter. That amount also covers anti-money-laundering compliance work, which the bank did not break out.

At JPMorgan, a founding Glasswing partner, Jamie Dimon said in May that the bank had "hundreds of people doing it full time". According to the bank, fixing its own applications alone will take "a year or so". On October 6, Dimon said cyber risk had gone up tenfold since Mythos, without explaining how he got there.

Open source: volunteers on the front line

The shock is harder on open source projects, often run by a handful of maintainers. According to Willy Tarreau, the Linux kernel security team went from two or three reports a week two years ago to five to ten a day in 2026. On May 17, Linus Torvalds called the kernel security list "almost entirely unmanageable".

The picture is the same elsewhere. OpenSSL's security inbox went from about 9 to about 70 reports a month. Daniel Stenberg, who maintains curl, receives four to five times as many reports as in 2024 and works 50-hour weeks. In September, Jean-Baptiste Kempf shipped a VLC release fixing more than 130 security issues, the largest in its history. At PyCon US, open source maintainers said security, once about 20% of their time, now takes "almost all" of it.

Vendors change pace

Major vendors have reorganized their updates. Chrome fixed 1,072 security bugs in two releases, more than in the previous 23 combined. Microsoft fixed 112 flaws on January's Patch Tuesday, and about 1,400 in October. Cisco and Adobe moved to two security releases a month. Palo Alto Networks published 26 CVEs in May, against fewer than five in a normal month.

For an IT department, that means more patches to install, from every supplier at the same time.

The bottleneck is fixing

On October 6, Anthropic said its partners had found "at least 129,000" verified vulnerabilities between April and July. The figure comes from a survey of 33 partners, with no independent audit. The dashboard Anthropic keeps for open source is more telling: as of October 2, 6,157 flaws had been reported to 591 projects, and 516 were fixed. Roughly one in twelve.

Anthropic acknowledges it: discovery is now limited "by how quickly we can verify, disclose, and patch". Fixing remains human work. At Mozilla, one engineer writes each fix and another reviews it: "We have not found it to be automatable".

We read these figures with caution: most of them come from Anthropic and its partners, and the maintainers who checked them closely put them in perspective. On curl, a Mythos report claimed five confirmed vulnerabilities: only one was real, and of low severity. Stenberg called the hype "primarily marketing". Greg Kroah-Hartman, the stable kernel maintainer, boiled the "79 Mythos flaws" in Linux down to ten real fixes, about an hour of work. At Palo Alto, none of the 75 issues found was critical: "Volume does not equal severity".

Mozilla also notes that Mythos found no bug "that couldn't have been found by an elite human researcher". What has changed is volume and price: these flaws are found all at once, for a fraction of the cost of a human team, and soon by anyone.

A patch goes out, an exploit follows within the hour

Until a patch is installed, it works as an instruction manual for attackers: the difference between the old and the new version shows exactly where the problem was. This is an "n-day" flaw, known and fixed, but not fixed everywhere yet.

That delay has been shrinking for years. According to Mandiant, a flaw took 63 days on average to be exploited in 2018-2019, and 5 days in 2023. For 2025, Mandiant estimates it at -7 days: exploitation often comes before the patch. Google observes 18 exploited vulnerabilities a month from January to August 2026, against 10.5 in 2025. It attributes most of the increase to the rapid exploitation of already patched flaws, possibly with AI comparing versions.

AI is very good at that comparison work. In June, Anthropic gave Mythos the public patches for 18 Firefox flaws: it produced a first proof of exploit in about 12 minutes, and a first working exploit in under an hour. From Windows binaries alone, without source code, it built eight complete attack chains for about $2,000 each. Anthropic's summary: we are no longer talking about "n-days" but "N-hours". Researchers at the University of California, Riverside, reproduce more than half of 100 Linux kernel flaws from the patch alone, in 19 minutes and $4 on average.

The European Central Bank uses the same scale: a patched flaw can be identified by criminals in "perhaps 30 minutes". The direct consequence: security patches must be installed as soon as they are released. A company that applies them on the rhythm of a monthly change board gives several weeks to attackers who only need a few hours.

Is self-hosted open source still viable?

The question comes naturally. When an open source project fixes a flaw, the patch is visible in its public repository, sometimes weeks before distributions ship it. An attacker watching the repository knows where to strike, and an AI agent can do the watching. Does that make self-hosted open source too risky?

The patch is public before it is installed

Copy Fail, a Linux kernel flaw, is a telling example. The fix was merged into the public repository on March 31, 2026, with a commit message that did not mention security. The flaw was only disclosed on April 29. Two days later, the US agency CISA added it to its catalog of actively exploited vulnerabilities.

The confidentiality rules that gave distributions time to prepare their packages are fading too. The kernel team asks that any bug found with AI be treated as public, since others have probably found it the same day. And the list that coordinates distributions generally considers that a fix already in a public repository does not justify an embargo. Distributions now do their work in the open.

The intuition is right on one point: when you self-host, you test, schedule and install. CISA puts it plainly: open source maintainers "are not the equivalent of a software producer", they owe you nothing.

Closed source is no better protected

But the argument stops there. Keeping your code private no longer protects you. Anthropic's eight Windows attack chains were built without source code. Akamai had AI analyze the patches from three Microsoft Patch Tuesdays, for an average of $0.14 per report.

Many of the most attacked on-premise products are in fact proprietary. At the end of August, nearly 22,000 IP addresses of internet-facing Exchange servers had not applied a critical patch; in Germany, the BSI estimates that about 85% of on-premise Exchange servers remain vulnerable. Citrix, Fortinet and Ivanti fill CISA's catalog, although open source web software such as WordPress or Drupal also ranks high. By contrast, Google counted about 5,000 Linux kernel CVEs between January and August 2026, with no zero-day exploited in the wild.

What no longer holds: the exposed service, patched once a month

What is being called into question is one way of running self-hosted open source: the internet-facing service patched once a month. LiteLLM, an open source gateway many companies host themselves to reach LLMs, is a case in point. The first targeted attacks on a critical flaw came 36 hours after its security advisory was indexed. Meanwhile, only 26% of known exploited vulnerabilities were fully fixed in companies in 2025, with a median of 43 days, according to Verizon's 2026 DBIR as cited by Tenable. CERT-EU puts enterprise patch cycles at 30 to 60 days, and sets the target at a few days for exposed critical flaws.

So the question to ask is less "open or proprietary?" than this one: who, in your organization, can apply a critical patch to an internet-facing service within 24 hours? LiteLLM shows that once an advisory is widely circulated, 36 hours are enough for attackers, even though the fix had been available for a week. If your team can, self-hosting remains a sound choice. If not, either take the service off the internet or hand its operation to someone who commits to it in a contract. SaaS does not make the risk disappear: according to the same Verizon report, 48% of breaches involve a third party. It moves the risk to a supplier whose commitments, and nationality, you need to check.

This is consistent with what we wrote about running LLMs locally: sovereignty is not the same as self-hosting, and the real cost of an on-premise deployment lies in operating it. Patching within hours is now part of that. One last nuance, which we raised about LiteLLM and LLM gateways, hit in March by poisoned releases on PyPI: patching fast means quickly installing a verified release from an official source, leaving a few hours for a possible compromise to surface.

Europe without the tool, but not without the problem

European companies face the same wave of patches as American ones, without access to the tool that triggered it. No European partner is named in Glasswing. In the EU, only ENISA, the EU cybersecurity agency, has been testing Mythos 5 since September. No eurozone bank and no national agency such as France's ANSSI has confirmed access. Christine Lagarde said such access "divides the level playing field between the U.S. and the rest of the world".

The ECB does not accept that as an excuse. "Lack of access is not an excuse for inaction", warned Frank Elderson, vice-chair of its Supervisory Board. A letter dated July 7 asks major European banks for an action plan against AI-enabled cyber threats by October 31, 2026. In France, BNP Paribas extended its partnership with Mistral AI, which according to Bloomberg has developed its own cyber model; its CIO, Marc Camus, sums it up: "The game changer is the speed at which we have to address vulnerabilities and the scale".

ANSSI, the French national cybersecurity agency, speaks of a "cadence problem" and a risk of saturating security teams. As early as April, before Mythos was even announced, its director general Vincent Strubel said at the InCyber Forum that "this battle over vulnerabilities is being lost". In October, at the Assises in Monaco, he called on the big AI vendors to "move beyond a somewhat marketing dimension". Meanwhile, the NIS2 directive, which imposes vulnerability management duties on thousands of companies, has still not been transposed in France: the bill was pulled from the National Assembly's agenda on October 6. We have already described Europe's digital dependence on the US; Mythos is a very concrete illustration of it.

What an IT department can do right now

You do not need access to Mythos to prepare. The recommendations of the UK's NCSC, CERT-EU and ANSSI overlap, and most of them are about patch management rather than AI.

1. List what is exposed to the internet. That is where the exploitation window is shortest. Whatever does not need to be publicly reachable goes behind a VPN or zero trust access: CISA recognizes this as a mitigation that buys more time to patch.
2. Set a target delay in hours for exposed critical flaws. US federal agencies have had three days for the most serious cases since June 2026. A monthly change board is no longer enough.
3. Automate what can be automated: automatic system updates, kernel patches without reboot (Livepatch, kpatch) where available, temporary protection with a web application firewall when no patch exists yet.
4. Require patching deadlines from your suppliers, software vendors and SaaS alike, and write them into the contract, as you do for availability in an SLA.
5. Verify before installing: move fast to a signed release from an official source, not to whatever was last pushed to a package registry.
6. Budget for fixing, not only for detection. Bank of America and JPMorgan show the order of magnitude: hundreds, even thousands of people for months.
7. Use AI for defense, preferably European or open source so as not to create a new dependency, as France's Campus Cyber recommends. To compare vendors on that criterion, see our page on sovereign AI.

Frequently asked questions about Claude Mythos

What is Claude Mythos?

Claude Mythos is an Anthropic AI model, unveiled on April 7, 2026 as Claude Mythos Preview, that can find and exploit unknown security flaws in major operating systems and browsers on its own. Anthropic has not released it to the public: it is reserved for vetted organizations and researchers through Project Glasswing, then the Cyber Verification Program. Its later versions, Mythos 5 and Mythos 5.1, came out in June and September 2026.

What is Project Glasswing?

Project Glasswing is the program Anthropic launched on April 7, 2026 to give organizations that maintain critical software access to Claude Mythos, so they can fix their flaws before equivalent capabilities spread. It brings together eleven founding partners, including AWS, Apple, Google, Microsoft and the Linux Foundation, plus more than forty other organizations at launch and about 150 more in June 2026. Anthropic committed as much as $100 million in credits and $4 million in donations to open source. Since October 6, 2026, Glasswing has been part of the Cyber Verification Program.

Can Claude Mythos be used in Europe?

Not by European companies, as far as we know. In September 2026, Anthropic reserved Mythos 5.1 for a set of US organizations; since October 6, its Cyber Verification Program has opened it to vetted organizations and researchers, with no stated geographic criterion, in partnership with the US government. In the EU, only ENISA, the EU cybersecurity agency, has been testing Mythos 5 since September 2026. No eurozone bank and no national agency such as France's ANSSI had confirmed access as of October 16, 2026.

How many flaws has Claude Mythos found?

Anthropic says its partners found at least 129,000 verified vulnerabilities between April and July 2026, a figure reported by 33 partners and not audited. For open source software, Anthropic had reported 6,157 flaws to 591 projects as of October 2, 2026, of which 516 were fixed. At Mozilla, a first pass with Mythos led to 271 flaws fixed in Firefox 150.

Should companies stop self-hosting open source because of AI?

No. No cybersecurity authority recommends it, and much of the most exploited on-premise software is proprietary (Exchange, Citrix, Fortinet). What becomes untenable is an internet-facing service patched once a month, open source or not. Self-hosted open source remains defensible if the team can apply a critical patch within 24 hours, or if the service is not publicly exposed.

How quickly should a security patch be applied?

For a critical flaw on an internet-facing service, within hours or a few days. Mandiant estimates that in 2025, exploitation came on average 7 days before the patch was released, and AI can now derive a proof of exploit from a patch in minutes, and a working exploit in under an hour. CISA gives US federal agencies three days for the most serious cases; CERT-EU recommends remediation "within days, not weeks".

What is a zero-day vulnerability?

A zero-day vulnerability is a flaw unknown to the software vendor, so no patch exists on the day it is discovered or exploited. An "n-day" vulnerability, by contrast, is already known and patched, but remains exploitable on every machine where the patch has not been installed. AI models such as Claude Mythos find zero-days at scale, and they also speed up the exploitation of n-days.

---

Mythos did not invent new attacks. It made cheap what used to be expensive: finding a flaw, and understanding a patch. The time between a patched flaw and an exploited one used to be a safety margin. That margin is gone. For any company, the question to ask this week is simple: how long does it take us to install a critical patch on our internet-facing services? If the answer is counted in weeks, that is where to start, whatever the software.