---
title: "Epoch Builds a Free Dashboard Tracking How Claude Mythos Is Flooding CVE Reports"
subtitle: "Epoch AI's new CVE explorer makes the AI-driven vulnerability surge visible — and the numbers are staggering"
url: "https://alphasignal.ai/news/epoch-builds-a-free-dashboard-tracking-how-claude-mythos-is-flooding-cve-reports"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "Epoch AI"
company_url: "https://alphasignal.ai/company/epochairesearch"
published: "2026-06-05T22:38:49.000Z"
updated: "2026-06-07T17:31:14.542Z"
type: "News"
topics:
  - "Security"
  - "Benchmarks"
subtopics:
  - "Red Teaming"
upvotes: 468
read_time: "8 min"
source_url: "https://epoch.ai/data/cve"
comments: 0
---

# Epoch Builds a Free Dashboard Tracking How Claude Mythos Is Flooding CVE Reports

> Epoch AI's new CVE explorer makes the AI-driven vulnerability surge visible — and the numbers are staggering

AI companies have been making bold claims about their models' ability to find software vulnerabilities. Epoch AI just built the tool to check whether those claims are bearing out in public data. The research organization launched its [Cyber Vulnerabilities Explorer](https://epoch.ai/data/cve), a free interactive dashboard that visualizes every Common Vulnerability and Exposure (CVE) reported to the CVE Program since 2022 , and the chart tells a striking story.

## What it is and how to use it

The explorer pulls from the [CVE Program's public repository](https://github.com/CVEProject/cvelistV5) and lets you slice the data in several useful ways:

- Filter by all reporting organizations or zoom into 21 notable vendors and open-source projects, including Microsoft, Google, Apple, Linux, Mozilla, and Apache
- Break down disclosures by CVSS severity level: Critical (9.0–10.0), High (7.0–8.9), Medium, Low, and Unknown
- Switch between weekly, monthly, and quarterly views, with optional trend lines
- Overlay key AI milestones directly on the chart , including the announcement of Claude Mythos Preview
- View individual High and Critical CVE records from notable vendors in a table view, each linking back to its official CVE entry

It's free, requires no login, and the underlying data is available for download under a Creative Commons Attribution license. If you want to cite it, Epoch AI provides both a standard citation and a BibTeX entry on the page.

## The spike that prompted the tool

The explorer visualizes the announcement date of Claude Mythos Preview (April 7, 2026), which coincided with a large jump in the number of new vulnerability reports.
That jump is not subtle.
Chrome reported a 563.2% increase in disclosure volumes year-to-date, VMware a 180.9% jump, and Apache 170.3%.
GitHub CVE issuance is also up significantly year-to-date (+476%), with GitHub indicating the increase is spread across many reporters and projects rather than concentrated in one source.

The backdrop matters here.
The cumulative drift in CVE volume is currently +46.3% above the original forecast for 2026, an excess of 6,420 CVEs, leading to a revised 2026 projection of roughly 68,000 CVEs.
AI-assisted discovery has increased the chances that we see what many people would consider an extreme number of vulnerabilities this year.

## What caused the surge: Anthropic's Project Glasswing

The proximate cause of the sharpest uptick is [Project Glasswing](https://www.anthropic.com/glasswing), Anthropic's coordinated vulnerability disclosure initiative powered by Claude Mythos Preview , an unreleased frontier model that Anthropic has declined to make publicly available.
Claude Mythos Preview is a general-purpose, unreleased frontier model that reveals a stark fact: AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.

In April 2026, Anthropic introduced Claude Mythos Preview, a new large language model that can autonomously find zero-day vulnerabilities and create exploits for them. The company also launched Project Glasswing and gave Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and other partners in the open source community access to the model, to help them secure critical software before AI systems can be used to target it.

The results one month in were remarkable.
Anthropic says Mythos has already helped its partners find more than ten thousand vulnerabilities overall, and most partners have each found hundreds of critical- or high-severity vulnerabilities in their software. The company said that its partners' rate of bug-finding has increased by more than a factor of ten.
Cloudflare alone found 2,000 bugs, 400 of which are high or critical in severity.

The open-source scan numbers are even more striking.
Anthropic scanned more than 1,000 open-source projects with Mythos and identified 23,019 issues, of which 6,202 were high- or critical-severity vulnerabilities. The company and six independent security research firms assessed 1,752 of those high- or critical-severity findings, and more than 90% were validated as true positives.

Mythos's capabilities go well beyond flagging individual bugs.
It combined four independent bugs into an exploit chain that bypassed both browser renderer and operating system sandboxing, performed local privilege escalation in Linux through race condition vulnerabilities, and created a remote code execution exploit targeting FreeBSD's NFS server with a 20-gadget ROP chain distributed across packets.
A ROP chain (Return-Oriented Programming) is an advanced exploit technique that strings together small snippets of existing code to execute arbitrary commands, even when defenses like no-execute memory are in place.
Mythos reproduced vulnerabilities and developed working exploits on the first attempt in over 83% of cases. In one documented instance, it uncovered a 27-year-old vulnerability in OpenBSD, an operating system famous for its security hardening.

## OpenAI's answer: Daybreak

The Daybreak initiative, announced in May, is OpenAI's answer to Anthropic's Project Glasswing.
It combines OpenAI models, Codex Security, and cyber-focused GPT-5.5 variants to help organizations identify, validate, and prioritize software vulnerabilities. Daybreak builds editable threat models from a company's code repository, analyzes realistic attack paths, validates likely vulnerabilities in isolated environments, and helps teams focus on exploitable issues instead of noisy alerts.

Three-tiered model variants govern access: GPT-5.5 for general use, GPT-5.5 with Trusted Access for Cyber for verified defensive workflows, and GPT-5.5-Cyber for authorized red teaming and controlled validation.
When defenders are vetted and approved for Trusted Access for Cyber, they receive lower classifier-based refusals to enable authorized cybersecurity workflows, including vulnerability identification and triage, malware analysis, binary reverse engineering, detection engineering, and patch validation.

## What the data can and can't tell you

Epoch AI is careful about what conclusions to draw. The CVE data has real noise in it.
The explorer notes that reporting practices vary substantially across organizations. For instance, Linux became a CNA (CVE Numbering Authority , the organization authorized to assign CVE IDs) in February 2024 and subsequently began assigning CVEs for thousands of backported bug fixes, leading to a high number of reports in 2024 and 2025.

There's also a disclosure lag that makes the picture murkier.
Anthropic's triage process means that fewer than 1% of the potential vulnerabilities discovered so far have been fully patched by their maintainers, meaning only a small fraction can be discussed publicly.
More disclosures of vulnerabilities unearthed with Mythos' help are yet to come, as the project was started just a couple of months ago and the coordinated vulnerability disclosure process typically takes time , newly discovered flaws are kept private, usually for 90 days or until patches are available, before being made public.

The quality signal is also improving over time, not just the volume.
Early AI-assisted vulnerability submissions started as low-quality noise, but over the past few months, the quality of incoming submissions has noticeably improved, and the underlying volume hasn't subsided.
GitHub confirmed the same pattern:
no single reporter accounts for more than roughly 3% of volume, and no single project accounts for more than roughly 7% , suggesting this is a systemic shift in how vulnerability reporting is happening across the ecosystem, not one person or one tool.

## The bottleneck nobody is talking about

The harder problem isn't finding bugs anymore , it's fixing them.
Vulnerability discovery is becoming less of a bottleneck, according to Anthropic. Security teams still need to verify findings, disclose issues, develop patches, and deploy updates.
Maintainers, many of them volunteers, are now expected to triage, validate, and fix issues at a rate they were never resourced for. Security teams downstream are buried in advisories, struggling to separate exploitable bugs from theoretical findings.

The exploitation side of the equation is also accelerating.
The median time from the first disclosure to the first observed exploitation dropped from 771 days in 2018 to single-digit hours by 2024, and by 2025, the majority of exploits were weaponized before being publicly disclosed.
Google's Threat Intelligence Group has identified a threat actor using a zero-day exploit that it believes was developed with AI , the criminal threat actor planned to use it in a mass exploitation event, but proactive counter-discovery may have prevented its use.

## What this means for your security posture

The Epoch AI explorer gives security teams, researchers, and policy makers a single place to track whether AI-driven vulnerability discovery is a real, sustained trend or a temporary surge. The data so far suggests it's the former.
Anthropic has warned that within 6 to 12 months, many other AI companies will likely have Mythos-class models, and they could release them without safeguards that prevent misuse. In that world, cyberattacks could occur much more often, and in much more unpredictable forms.

For teams managing software dependencies, the practical implication is straightforward: the CVE queue is going to keep growing, and the window to patch before exploitation is shrinking.
Defenders should prepare for higher vulnerability volumes while continuing to use threat intelligence to prioritize emerging threats that are being actively exploited or likely to be.
The Epoch AI explorer is now one of the cleaner public tools for watching that trend in real time.

## Sources

- [X post by @epochairesearch](https://x.com/epochairesearch/status/2063027791638237487)
- [Epoch AI Cyber Vulnerabilities Explorer](https://epoch.ai/data/cve)
- [Anthropic Project Glasswing](https://www.anthropic.com/glasswing)
- [Claude Mythos Preview — Anthropic Red Team](https://red.anthropic.com/2026/mythos-preview/)
- [VulnCheck: The First CVE Wave](https://www.vulncheck.com/blog/ai-assisted-vulnerability-discovery)
- [OpenAI Daybreak](https://openai.com/daybreak/)