Anthropic's Claude Mythos Triggers a 3.5x Record CVE Spike

A single chart from Epoch AI tells a striking story: in June 2026, 21 major tech organizations disclosed roughly 1,500 high- and critical-severity CVEs , more than 3.5 times the previous monthly record. The timing is not a coincidence. The spike follows Anthropic's announcement that Claude Mythos Preview could autonomously discover software vulnerabilities, and the launch of Project Glasswing, a coordinated defensive effort with major industry partners.

A model that broke the benchmarks

Anthropic formed Project Glasswing because of capabilities observed in a new frontier model: Claude Mythos Preview, a general-purpose, unreleased frontier model that reveals AI has reached a level of coding capability where it can surpass all but the most skilled humans at finding and exploiting software vulnerabilities. This is not a security-specific model , it is a general reasoning model that turned out to be extraordinarily good at one of the hardest tasks in software engineering.

Anthropic had historically relied on internal and external benchmarks to track vulnerability discovery capabilities, but Mythos Preview improved to the extent that it mostly saturated those benchmarks. The team had to shift to testing against real-world, previously unknown bugs , called zero-days , to get a meaningful signal.

The results were alarming. Engineers at Anthropic with no formal security training asked Mythos Preview to find remote code execution vulnerabilities overnight, and woke up the following morning to a complete, working exploit. In one documented case, Mythos Preview fully autonomously identified and exploited a 17-year-old remote code execution vulnerability in FreeBSD that allows anyone to gain root on a machine running NFS , and no human was involved in either the discovery or exploitation after the initial request.

The performance gap versus previous models is stark. Claude Opus 4.6 had a near-zero success rate at autonomous exploit development , in one Firefox test, it turned discovered vulnerabilities into working exploits only twice across several hundred attempts, whereas Mythos did it 181 times.

Project Glasswing: a controlled defensive coalition

Faced with a model that could essentially hack anything, Anthropic made a deliberate choice: don't release it publicly. Instead, by releasing the model initially to a limited group of critical industry partners and open source developers with Project Glasswing, the aim is to enable defenders to begin securing the most important systems before models with similar capabilities become broadly available.

Project Glasswing gave access to Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and other partners in the open source community. The financial commitment is substantial: Anthropic is backing this with up to $100 million in usage credits and $4 million in direct donations to open-source security organizations.

The results from Glasswing have been significant. Several companies including Cloudflare and Mozilla have discovered hundreds of vulnerabilities in their codebases, while Anthropic has scanned more than 1,000 open-source projects with Mythos, identifying 23,019 issues, of which 6,202 were high- or critical-severity vulnerabilities. More than 90% of those high- or critical-severity findings were validated as true positives by independent security research firms.

OpenAI's parallel push

Anthropic is not alone. OpenAI launched Daybreak, a cybersecurity initiative that brings together frontier AI model capabilities and Codex Security to help organizations identify and patch vulnerabilities before attackers find a way in. The effort is built on three models: GPT-5.5 for general use, GPT-5.5 with Trusted Access for Cyber for verified defensive work, and GPT-5.5-Cyber , a more permissive model for red teaming, penetration testing, and controlled validation.

Daybreak has already produced concrete results. OpenAI found CVE-2026-8390, a critical vulnerability in Firefox, during safety evaluations. Mozilla patched it two days before Pwn2Own Berlin , a major competitive security event , prompting five of six registered Firefox exploit entries to withdraw. Since launch, Codex Security has scanned more than 30 million commits across 30,000 codebases, with more than 500,000 findings automatically determined to be fixed.

The numbers behind the spike

Epoch AI's analysis, authored by Luke Emberson, tracked CVE disclosures from 21 notable organizations including Microsoft, Google, Apple, Adobe, Oracle, Cisco, Intel, AMD, NVIDIA, and others. The key figures:

• ~1,500 high- and critical-severity CVEs disclosed in June 2026 , more than 3.5x the previous monthly record
• 23,019 total issues identified by Anthropic across 1,000+ open-source projects, with 6,202 high- or critical-severity
• $100 million in Glasswing usage credits plus $4 million in direct donations to open-source security orgs
• The full-year 2026 CVE forecast has been revised to approximately 66,000 , up from an earlier projection of 59,427
• CVE disclosure volumes are up sharply year-to-date across major suppliers: Chrome (+563%), VMware (+181%), Apache (+170%), Mozilla (+157%)

The real bottleneck: patching, not finding

Here is the uncomfortable truth beneath the headline numbers. The most consequential implication of Mythos and Glasswing is not the discovery of new flaws , it is the devaluation of discovery itself. We are approaching a reality where detecting vulnerabilities is abundant and cheap, but the ability to fix those issues remains partially human, finite, and in the case of open source, largely voluntary.

HackerOne paused its internet bug bounty program earlier this year, citing a shift in the balance between vulnerability discoveries and the ability for open-source maintainers to address them. This has had the side effect of triage fatigue, where project maintainers are required to sift through a flood of vulnerability reports, some of which could be plausible-sounding but entirely hallucinated by AI models.

The median time from first disclosure to first observed exploitation dropped from 771 days in 2018 to single-digit hours by 2024, and by 2025, the majority of exploits were weaponized before being publicly disclosed. AI-scale discovery into that environment is a double-edged sword: defenders get more signal, but attackers can weaponize disclosures faster than ever.

Analysts at FIRST offer a useful reframe. Only about 7% of 2026 CVEs clear the actionable threshold of real-world exploitability , the remaining 93% represent background noise. However, while the pool of actionable risk remains stable, the time window to react to that 7% has collapsed. The problem is not the volume. It is the speed.

Who wins, who loses

The organizations inside Glasswing and Daybreak are in a privileged position. They are getting their codebases scanned by the most capable vulnerability-hunting AI ever built, before that same capability proliferates to adversaries. The vulnerabilities Mythos discovers will flow downstream to every enterprise , when a critical zero-day is found in the Linux kernel or a widely used open-source library, the CVEs get published, scanner signatures get updated, and suddenly every organization running that software has a new critical finding to address. The scale of Mythos's discovery capability means the volume of these downstream findings will increase substantially.

The losers, at least in the short term, are open-source maintainers. Maintainers, many of them volunteers, are now expected to triage, validate, and fix issues at a rate they were never resourced for. Anthropic says that even though they made sure to deliver detailed vulnerability reports to open source maintainers, the latter have become a major bottleneck in the AI-driven vulnerability discovery process.

Anthropic's own team estimates that similar capabilities will proliferate from other AI labs within six to eighteen months. OpenAI is reportedly developing a model with comparable abilities. The window for defenders to prepare is narrow.

What this means for security teams right now

The CVE surge is not a crisis to panic about , but it does demand a change in operating model. Here is what matters practically:

• Patch prioritization is now the core skill. Patching speed will become the primary security metric. If vulnerabilities can be found autonomously and at scale, the window between discovery and exploitation shrinks to near zero. Mean time to remediate for internet-facing services will need to be measured in hours, not days or weeks.
• The 90-day disclosure window is under pressure. Once a legitimate CVE is published, the time required for threat actors to reverse-engineer an exploit using generative tools has shrunk from weeks to hours.
• Open-source dependencies are the new attack surface. When a critical zero-day is found in a widely used open-source library or browser engine, the CVEs get published and suddenly every organization running that software has a new critical finding to address.
• AI-generated code introduces new bugs at scale. The problem is not only that AI finds more vulnerabilities , it is that AI-assisted development produces more vulnerabilities to be found. Developers using AI coding assistants write code significantly faster, but that speed comes with a hidden cost: the code contains security flaws at a dramatically higher rate.

The defining question , whether defenders can use frontier models to patch vulnerabilities faster than attackers can exploit them , remains open. The coming race between AI-accelerated exploit generation and AI-accelerated patch generation will be one of the defining security dynamics of late 2026. The CVE spike is the opening gun. The race has already started.