Claude mythos found 23,000+ vulnerabilities across 1,000+ open source projects, and 1,726 of them…
claude mythos found 23,000+ vulnerabilities across 1,000+ open source projects, and 1,726 of them are externally confirmed. a single agent out-scanned most security teams in one pass.
the bottleneck was never finding bugs, it's triaging what an agent hands you.
Context
Anthropic's Glasswing update, dated 22 May 2026 by search metadata, says Mythos Preview was used to scan more than 1,000 open-source projects and found what it estimates are 6,202 high- or critical-severity vulnerabilities out of 23,019 in total including medium and low. It says 1,752 high or critical findings were assessed by one of six independent security firms or by Anthropic, with 90.6% (1,587) valid true positives and 62.4% (1,094) confirmed high or critical. A later Anthropic disclosure page, as of 26 August 2026, reports 2,300 vulnerabilities disclosed across 392 projects. SecurityWeek, 25 May 2026, headlines them as potential vulnerabilities.
The 23,000 is a model estimate, not a validated count. The note's 1,726 externally confirmed does not appear in the text read, where the validation figures are 1,752 assessed, 1,587 valid and 1,094 confirmed high or critical, so 1,726 is unverified. Anthropic's own text says the bottleneck is human capacity to triage, report and patch, which matches the note. Out-scanned most security teams is the author's opinion.
Related work
- Anthropic Mythos detected 23,000 potential vulnerabilities (SecurityWeek, 25 May 2026) ↗Partly read.
- Coordinated vulnerability disclosure (Anthropic Red Team) ↗Column labels ambiguous in the extract.
Watch next
- Updated confirmed and patched counts.
Sources
- Glasswing initial update (Anthropic, 22 May 2026)anthropic.com
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 18 September 2026 at 05:30 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →