Mythos is Anthropic’s latest AI model, and it is stirring up a tornado of concern in cybersecurity circles. Even before its release, Mythos discovered thousands of new sensitive vulnerabilities in commercial and open-source software, including all major operating systems and web browsers. One was in existence for over 27 years without the industry noticing.
Based on what it found, Anthropic felt it was so potentially dangerous that it throttled the initial release to a very limited number of close partners. This initial scan was conducted in-house by Anthropic, in a very short time, evaluating a limited number of systems, and not a result of having the global community of developers and vulnerability researchers use the tool.
Nobody has been willing to estimate what that would look like, but it will likely be orders of magnitude more than is currently being discovered.
One of the partners, Mozilla, used Mythos to evaluate its popular Firefox browser. Anthropic’s current model, Opus 4.6, identified 22 security-sensitive bugs in the previous version that were patched. Mythos identified an additional 271 bugs.
At that rate, if we extrapolate the number of vulnerabilities discovered in 2025, about 50 thousand, we would expect to see over 600 thousand vulnerabilities discovered in the 12 months following the widespread accessibility of Mythos.
The industry does not currently understand the downstream impacts of that scale.
And the problem does not end with vulnerabilities.
Mythos excels at 3 things.
1. Vulnerability discovery — it does it faster, deeper, and across the stacks
2. Exploit creation — the automatic creation of hacks that previously required human guidance and a lot of time
3. Vulnerability chaining — stitching together lesser vulnerabilities in ways humans can’t easily comprehend.
Combined, these three capabilities pose a significant risk as hackers use modern AI tools to orchestrate attacks to move quickly and outmaneuver security defenders. Now they have tremendous power and speed.
Everyone. Software developers, cybersecurity, every industry — including critical infrastructures like healthcare, telecommunications, transportation, and power. Recently, the heads of top Wall Street finance firms met to discuss how Mythos may put global banking at risk. The White House also called in Anthropic to discuss the risks to government agencies, departments, and national critical infrastructures.
And let me be clear, Anthropic is not a security company. They are a brilliant AI company. So, what are the cybersecurity companies that had early access saying? They are also very concerned.
The speed of vulnerability discovery will shrink to a small fraction of what it is now. The number of vulnerabilities discovered will rise sharply. Exploits will be created very soon after discovery for all of them, not just a select few, and more zero-day attacks will happen. This will tie up security operations, crisis response, digital forensics, and incident response. This doesn’t just put pressure on developers; it crushes their patching process and system for security assurance.
Take for example Microsoft’s Patch Tuesday, which occurs on the 2nd Tuesday of every month. This cadence reflects a balance between the time it takes to validate a vulnerability, prepare and test a patch, and deploy it to customers; versus the time it takes for attackers to build an exploit for the vulnerability and use it against victims. There is a window of time, about a month, that Microsoft has to manage the risk.
But if AI models, like Mythos, can find a vulnerability, create an exploit, and attack victims in hours or days, this entire operating model becomes too slow and ineffective.
The Time-to-Exploit, which is the gap between vulnerability announcement and exploitation is dramatically decreasing, from years to hours, and soon to minutes. That is the window where patching must occur to be effective.
This impacts everyone:
· Developers — when they design, build, and test products — and future updates — before they are released
· Vuln Researchers — both ethical and unethical, including those in the grey areas
· Security Operations — as more exploitations emerge, they must be detected and mitigated
· Patch team developers, Quality & Assurance, and deployment — a dramatic increase in overseeing the number of reported vulnerabilities, which means the validation, the comprehension of what those vulnerabilities are, patch creation, testing, and development takes time and effort. And many of these people are the ones building the next products or features.
· Crisis Management & DFIR — more exploitations result in crisis events and all the work needed to understand and remediate them, including digital forensics.
· Partners/Suppliers/Vendors/Customers/End-users — The 3rd party risks increase in relation to the number of vulnerabilities and exploits that partners may be affected by, and the compromises impact customers.
· National Critical Infrastructures — The most sophisticated and powerful attackers, those sponsored or run by nations, will have access to these models and resources to use in their attacks against adversaries’ critical infrastructures, like power, water, telecommunications, shipping and logistics, and government services. Attacks impact us all.
This shows the percentage of vulnerabilities that were exploited on or before the date of disclosure. It highlights the race that security is losing.
Adaptation is absolutely required. Defenders must adopt AI tools as fast as possible to counter the attackers’ new capabilities. They need to use AI to proactively find the vulnerabilities before researchers so that they can be remediated. They have to adopt AI tools to detect when new vulnerabilities are being exploited in the wild to trigger a rapid response. And AI solutions will need to develop, test, and deploy effective patches in potentially suboptimal operating conditions.
Executive leadership must realize that with the window shrinking between vulnerability discovery and exploit, patching won’t be a monthly exercise. Instead, moving closer to a continuous updating model, perhaps multiple times a day in the future, which can cause business disruption, customer dissatisfaction, and other issues if not addressed at the architectural levels.
Mythos is not an event, but rather a signal of change. It is not a single problem that the technology industry must come to terms with, but rather a vector of how AI’s accelerating vulnerability and exploit capabilities will undermine current cybersecurity norms and practices. Other AI models are racing to provide similar or better capabilities, and all of them will continue to advance, likely at an even faster pace, forcing cybersecurity to adapt at the same rate to remain effective.
Mythos has not just accelerated vulnerability discovery, but rather it has crushed the foundations of how we manage and make decisions regarding the protection and trust of digital systems. Digital security must now transform its adaptive capabilities so it can maintain effectiveness, and nobody yet knows how exactly to do that.
