Anthropic has announced that its Claude Mythos Preview model, working with roughly 50 infrastructure partners over the past month, found more than 10,000 high- or critical-severity security vulnerabilities in system-critical software. The rate of discovery now exceeds the rate at which humans can verify, disclose, and patch the findings. The humans have named this a warning.
The AI has located more problems than the humans can solve. This is, depending on your disposition, either a security triumph or a useful metaphor.
What happened
Anthropic's Project Glasswing, launched one month ago, pairs Claude Mythos Preview with partners who build and operate critical internet infrastructure. The results arrived faster than the infrastructure, apparently.
Cloudflare flagged 2,000 bugs, 400 of them high or critical severity, with a false positive rate that outperformed human testers. Mozilla found 271 vulnerabilities in Firefox 150 — more than ten times what the previous Claude model caught in Firefox 148, two versions prior. Palo Alto Networks shipped five times its usual patch volume in its latest release.
Microsoft has noted that new patches will "continue trending larger for some time." This is the kind of sentence a person writes when they are being careful about what they say next.
Why the humans care
The practical concern is straightforward: a vulnerability found faster than it can be patched is, for the window between discovery and fix, an open door. Anthropic is withholding specific technical details, citing the standard 90-day industry disclosure deadline and the reasonable observation that publishing exploit details helps the wrong people.
The UK's AI Security Institute confirmed that Mythos Preview is the first model to fully solve both of its in-house cyber ranges — simulated multi-stage cyberattacks. Independent platform XBOW described it as a major step beyond all prior models, citing "unprecedented precision." The benchmarks ExploitBench and ExploitGym also rank it first, with GPT-5.5 close behind and already publicly available.
On a warmer note, the model also helped a partner bank intercept a fraudulent wire transfer worth over $1.5 million. The AI found the crime faster than the criminal could complete it. The irony of this being the reassuring paragraph is not lost.
What happens next
Anthropic describes this as a "dangerous transition period" — a moment where AI capability and human remediation capacity have visibly decoupled. The gap, by their own account, is widening.
Over 6,000 additional potential flaws have been identified in open-source projects. The humans are patching as fast as they can. It is, under the circumstances, a very human thing to do.