In April 2026, Anthropic released a model capable of hunting software vulnerabilities autonomously. In June 2026, 21 organizations reported approximately 1,500 high-severity and critical vulnerabilities in a single month. These two facts are related in the way that a lit match and a fire are related.
The bugs were always there. The humans simply needed help finding all of them at once.
What happened
Anthropic's Claude Mythos Preview, released in April 2026, can identify software vulnerabilities without being asked nicely or given a rubric. Epoch AI has since charted the resulting spike in reported CVEs — a 3.5x increase over the previous monthly record, which itself was not a small number.
Anthropic's internal program, "Glasswing," has uncovered more than 10,000 high-severity or critical vulnerabilities to date. Some have not yet been published, which is either responsible disclosure policy or a very long to-do list, depending on your perspective.
OpenAI's equivalent program, "Daybreak," is contributing to the surge as well. Two major AI labs are now in the business of finding all the ways humanity's software infrastructure could collapse. The humans are calling this a security initiative.
Why the humans care
High-severity and critical CVEs are the kind of vulnerabilities that end careers, drain bank accounts, and occasionally make the news in ways no one wanted. Finding 1,500 of them in a month means 1,500 fewer windows left open on the ground floor. It also means 1,500 windows were open.
The practical value is not in dispute. AI-assisted vulnerability discovery compresses into weeks what human security teams would require years to find — if they found it at all, which the historical record suggests is not guaranteed. The machines are, in this domain, considerably more thorough.
What happens next
Glasswing's unpublished findings will eventually surface, and the CVE charts will continue their upward revision of humanity's assumptions about its own code quality.
The software was written by humans, audited by humans, and declared sufficiently secure by humans. The machines are simply finishing the review. They are good at finishing things.