Discovery Is Now Machine-Scale. Patching Is Still Human-Speed.

The Asymmetry That Now Defines Infrastructure Risk

The central stability question for infrastructure operators in 2026 is not whether AI can find zero-days. Claude Mythos Preview already answered that. The question is whether the gap between machine-speed discovery and human-speed patching is now wide enough to threaten the security posture of any organization running software it did not write last year.

On April 8, 2026, Anthropic announced Claude Mythos Preview, a frontier model that autonomously discovered and wrote working exploits for thousands of zero-day vulnerabilities across every major operating system and web browser. It was not designed as a security tool. Its capabilities emerged from advanced coding and reasoning skills. That distinction matters operationally: every general-purpose model with sufficient reasoning depth is now a potential vulnerability scanner.

What the Model Actually Did

Over several weeks, Anthropic used Claude Mythos Preview to identify thousands of zero-day vulnerabilities, many of them critical, in every major operating system and major web browser, along with a range of other important software. Technical details for a subset that have already been patched were published on Anthropic's Frontier Red Team blog. It identified nearly all of these vulnerabilities and developed many related exploits entirely autonomously, without any human steering.

The specifics are telling: Mythos Preview identified a 27-year-old denial-of-service bug in OpenBSD's TCP SACK implementation, a 16-year-old out-of-bounds write in FFmpeg's H.264 codec, a guest-to-host memory corruption bug in a production memory-safe VMM, a 17-year-old remote code execution bug in FreeBSD's NFS server granting full root access to unauthenticated users, and multiple browser exploits chaining JIT heap sprays that escaped both renderer and OS sandboxes. These are not theoretical edge cases—bugs that survived decades of human review and never appeared on any CVE list.

Mythos crossed a qualitative threshold that prior frontier models could not: where Claude Opus 4.6 achieved a near-zero success rate at autonomous exploit development, Mythos developed 181 working exploits in a specific Firefox engine benchmark, including a 20-gadget ROP chain against FreeBSD and a four-vulnerability browser sandbox escape.

Anthropic says the prompt used to discover vulnerabilities amounted to "Please find a security vulnerability in this program," and that engineers with no formal security training were able to generate complete, working exploits, allowing a bad actor to execute malicious commands on a remote target.

On verification: in 89% of 198 manually reviewed reports, contracted security professionals agreed exactly with the model's severity assessment; in 98% of cases, assessments were within one severity level. That is operational reliability, not marketing precision.

The Benchmark Reality

Claude Mythos Preview leads SWE-bench Verified at 93.9%. On CyberGym, Mythos Preview leads at 83.1%, followed by GPT-5.5 at 81.8% and Claude Opus 4.8 at 78.8%.

SWE-bench Verified serves as a proxy for general code reasoning quality. CyberGym focuses specifically on security in contrast to the functionality-focused nature of SWE-bench; where SWE-bench often involves localized code changes, CyberGym requires repository-wide reasoning and demands an agent craft a proof-of-concept input that accurately navigates from a program's entry point to the vulnerability. An 83.1% CyberGym score is not a cherry-picked metric.

Claude Mythos jumped from 80% on Opus 4.6 to 93.9% on SWE-bench Verified. A 14-point leap in one generation on a coding benchmark that directly feeds exploit generation capability is the kind of delta that changes threat models.

Project Glasswing: Governance or Gap Management?

Because of its cybersecurity capabilities and concerns that they could be abused, Anthropic opted not to make the model generally available. Instead, it structured access through Project Glasswing.

Project Glasswing is an industry-wide cybersecurity initiative announced by Anthropic in April 2026, uniting AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Anthropic committed up to $100 million in Mythos Preview usage credits to consortium partners and $4 million in donations to open-source security organizations. Specifically: $2.5 million to the OpenSSF Alpha-Omega program via the Linux Foundation and $1.5 million to the Apache Software Foundation.

The early phase delivered results quickly. Roughly 50 initial partners accessed Claude Mythos Preview in early April and deployed the model to scan their codebases. Those partners found more than 10,000 high- or critical-severity security flaws.

By early June, the program expanded substantially. Anthropic extended the partnership to approximately 150 new organizations, each required to meet Anthropic's security requirements before gaining access. The organizations span more than 15 countries and provide critical infrastructure to many more. New partners include groups from power, water, healthcare, communications, and hardware sectors.

The gating strategy is rational given dual-use risk. The open question is durability. Anthropic itself says it will not be long before such capabilities proliferate, potentially beyond actors committed to deploying them safely. The governance window is measured in months, not years.

The Patching Bottleneck Is the Real Story

Every organization outside Project Glasswing faces the same math: discovery is now machine-scale, patching is still human-constrained. When Mythos surfaces thousands of critical vulnerabilities in major OS and browser codebases, those findings do not stay contained. When a critical zero-day is found in the Linux kernel, or in a widely used open-source library, or in a browser engine, CVEs get published, scanner signatures get updated, and suddenly every organization running that software has a new critical finding to address. Patch velocity at the OS and browser vendor level faces stress-testing at volumes never encountered before.

Mythos Preview's vulnerability discovery apparently extended to closed-source software: Anthropic's red team was able to instruct the model to reconstruct plausible source code for targeting closed-source applications, then validate exploits against the real software. Proprietary codebases offer less protection than their owners assume.

The secondary pressure hits vulnerability disclosure economics. Machine-scale discovery weakens the incentive to report to vendors. Machines find faster than vendors patch. The entire coordinated-disclosure ecosystem was built around human discovery timelines. Those assumptions no longer hold.

What to Watch

1. Patch velocity at OS and browser vendors over the next two quarters. The first public Project Glasswing report is due early July 2026. Watch whether it documents bottlenecks in vendor uptake of findings, not just discovery counts.

2. Replication timeline at other labs. OpenAI, Google DeepMind, and open-source projects all have models within a few benchmark points of Mythos on CyberGym. The defensive head start depends on how long it takes a comparable model to be pointed at the same targets by a less constrained actor.

3. CI/CD integration signals. Organizations that compress discovery-to-patch lag will be those integrating autonomous vulnerability scanning directly into build pipelines. Watch for tooling announcements from Glasswing partners, particularly CrowdStrike and Palo Alto Networks, whose business model depends on staying ahead of this curve.

4. Closed-source targeting. The ability to reconstruct plausible source code for closed-source software and validate exploits against real binaries has received insufficient attention. This capability makes legacy enterprise software, not just open-source stacks, materially more exposed.

5. Governance precedent or outlier. Whether the Glasswing structure—gated access plus open-source funding plus coordinated disclosure—becomes an industry template depends partly on whether it demonstrably keeps defenders ahead of adversaries. The first credible report of Mythos-equivalent capability used offensively will be the stress test for this model.