{"id":1029,"date":"2026-05-23T13:13:53","date_gmt":"2026-05-23T13:13:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1029"},"modified":"2026-05-23T13:13:53","modified_gmt":"2026-05-23T13:13:53","slug":"claude-mythos-ai-finds-10000-high-severity-flaws-in-widely-used-software","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1029","title":{"rendered":"Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 23, 2026<\/span><\/span>Artificial Intelligence \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Anthropic on Friday disclosed<\/a> that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most \u00absystemically\u00bb important software across the world since the cybersecurity initiative went live last month.<\/p>\n

Project Glasswing is an effort led by the artificial intelligence (AI) company, as part of which a small set of about 50 partners have obtained access to Claude Mythos Preview, a frontier model with capabilities to find vulnerabilities in widely-used software.<\/p>\n

Of these vulnerabilities, 6,202 have been classified as high- or critical-severity flaws impacting more than 1,000 open-source projects. Subsequent analysis of these vulnerability candidates has identified that 1,726 are valid true positives. As many as 1,094 flaws are assessed to be either high- or critical-severity.<\/p>\n

One of the identified weaknesses is a critical flaw in WolfSSL (CVE-2026-5194<\/a>, CVSS score: 9.1) that could allow an attacker to forge certificates and masquerade as a legitimate service. In all, these efforts have led to 97 findings being patched upstream and 88 advisories being issued.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe relative ease of finding vulnerabilities compared with the difficulty of fixing them amounts to a major challenge for cybersecurity,\u00bb Anthropic acknowledged. \u00abConfronting this challenge successfully will make our software far safer than before.\u00bb<\/p>\n

<\/p>\n

The development comes as software vendors are shipping more fixes<\/a> than ever before<\/a>, driven by a surge in AI-assisted vulnerability discovery, with Microsoft noting that the number of new patches it expects to release on a monthly basis to \u00abcontinue trending larger for some time.\u00bb<\/p>\n

Autonomous offensive security platform XBOW has described<\/a> Mythos Preview as \u00aba major advance\u00bb that’s \u00absubstantially better than prior models at finding vulnerability candidates\u00bb and \u00abadept at analyzing source code with a security mindset.\u00bb Recent analyses have also found the model to excel at turning vulnerabilities<\/a> into end-to-end attack chains<\/a>.<\/p>\n

\"\"<\/a><\/div>\n

Mythos Preview’s utility, Anthropic added, goes beyond finding security flaws. In one case, a Glasswing partner bank is said to have leveraged the AI model to detect and prevent a fraudulent $1.5 million wire transfer after an unknown threat actor breached a customer’s email account and made spoof phone calls.<\/p>\n

Given that models with similar capabilities to Mythos could become broadly available in the near future, Anthropic is urging software developers to shorten their patch cycles and make security fixes available. It’s worth mentioning here that Oracle has recently shifted to a monthly patch cycle<\/a> to address critical security issues.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abNetwork defenders should shorten their patch testing and deployment timelines,\u00bb Anthropic said. \u00abThese include steps like hardening networks’ default configurations, enforcing multi-factor authentication, and keeping comprehensive logs for detection and response.\u00bb<\/p>\n

The AI company also said it has launched a Cyber Verification Program<\/a> that allows security professionals to use its models without guardrails for legitimate purposes such as vulnerability research, penetration testing, and red teaming. This is similar to OpenAI’s Daybreak, which also allows defenders to leverage GPT-5.5-Cyber<\/a> for specialized workflows.<\/p>\n

Models like Mythos Preview and GPT-5.5-Cyber have yet to be released to the public owing to concerns that there currently exist no adequate safeguards to prevent their misuse at a large scale.<\/p>\n

\u00abGlasswing helps the most systemically important cyber defenders gain an asymmetric advantage,\u00bb it pointed out. \u00abHowever, there is an urgent need for as many organizations as possible to shore up their cyber defenses. We hope that our generally available models, and the new tools, resources, and research we’re providing to accompany them, will support those organizations to improve their cybersecurity posture.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802May 23, 2026Artificial Intelligence \/ Vulnerability Anthropic on Friday disclosed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most \u00absystemically\u00bb…<\/p>\n","protected":false},"author":1,"featured_media":1030,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[9,509,11,516,1116,588,920],"class_list":["post-1029","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-claude","tag-finds","tag-flaws","tag-highseverity","tag-mythos","tag-software","tag-widely"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1029","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1029"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1029\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1030"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1029"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1029"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1029"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}