Loading story…
AI-assisted vulnerability research is contributing to a sharp rise in disclosed high- and critical-severity software flaws, with monthly totals reportedly climbing from fewer than 100 to more than 600. Anthropic's Project Glasswing reportedly identified over 10,000 high- or critical-severity issues, while exploitation of disclosed vulnerabilities is increasingly occurring on the day of disclosure or earlier, making patch cycles measured in weeks inadequate.
Okta used pre-release OpenAI and Anthropic frontier models through the Daybreak Cyber Partner Program and Project Glasswing to scan high-priority customer-installed software across hundreds of repositories. Its testing found that autonomous agents frequently generated false positives or overstated severity, while expert-led investigation, manual reproduction, and triage substantially improved results. VMware similarly prioritized fixes found after adopting Claude Mythos and Project Glasswing, releasing VCF 9.1.1 as a security-focused update and delaying planned VCF 9.2 features.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Reported high- and critical-severity vulnerability disclosures reached roughly 2,500 in July, nearly five times the pre-Mythos baseline and 60% above the June total.
By June, 21 named technology organizations, including Microsoft, Google, Apple, Adobe, Oracle, Cisco, and IBM, had disclosed approximately 1,500 high- and critical-severity CVEs. The reported total was more than 3.5 times the previous monthly record.
Epoch AI data indicated that public disclosures of high- and critical-severity vulnerabilities by major technology companies began increasing sharply in spring 2026, rising from a baseline of a few hundred per month toward more than 600.
VMware unveiled the major Cloud Foundation 9.0 release.
Okta used OpenAI's GPT 5.5 Cyber Preview and Anthropic's Mythos Preview through the Daybreak Cyber Partner Program and Project Glasswing to scan hundreds of repositories and millions of lines of code. Human Product Security engineers triaged, reproduced, and reported potential vulnerabilities, finding that expert-guided investigations improved results over autonomous scanning.
Anthropic's AI-powered Project Glasswing vulnerability-discovery effort reportedly surfaced more than 10,000 high- or critical-severity vulnerabilities, many of which had not yet been individually disclosed.
VMware made Cloud Foundation 9.1.1 generally available, consolidating security patches associated with vulnerabilities identified through Anthropic Claude Mythos and Project Glasswing. Broadcom deferred planned VCF 9.2 feature work to prioritize remediation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
sec.okta.com
Open sourcecybersecuritynews.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic's Project Glasswing reportedly generated **26,153** open-source vulnerability findings, but public disclosure records show a far smaller number progressing through validation and remediation. Public coordinated-vulnerability-disclosure cards across eight projects document 12 CVEs and five GHSAs—including three critical and seven high-severity cards—while attributing the accepted work to Glasswing without identifying a specific Anthropic model in most cases. Only `CVE-2026-4747` has separate primary-source attribution to Mythos. The disparity illustrates that AI-assisted discovery can outpace human triage, patch authoring, maintainer review, and enterprise deployment. Anthropic's public ledgers reportedly reflected about 202 fixed vulnerabilities after five months, while Trail of Bits and OpenAI's Patch the Planet found 1,646 issues in 59 codebases but had only 215 merged patches as of September 4. Organizations should expect larger vulnerability queues and prioritize remediation using evidence of exploitation, asset reachability, compensating controls, and business exposure rather than CVSS scores alone.
Sep 16, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026
Anthropic unveiled **Claude Mythos Preview**, an unreleased AI model it says can autonomously discover and exploit severe software vulnerabilities across major operating systems, browsers, open-source projects, and some closed-source targets. The company said the model uncovered thousands of high-severity flaws, including long-lived bugs in **OpenBSD**, **FFmpeg**, Linux kernel privilege-escalation chains, and **`CVE-2026-4747`**, a FreeBSD NFS remote code execution flaw that could enable unauthenticated root access. Anthropic withheld broad release, citing offensive cyber risk, and instead launched **Project Glasswing**, a gated program for roughly 40 to 50 partners such as AWS, Apple, Cisco, Cloudflare, Google, JPMorgan Chase, Microsoft, Mozilla, NVIDIA, and Palo Alto Networks to validate findings, patch affected software, and study defensive uses. Independent and industry assessments broadly agreed Mythos marks a significant advance in AI-enabled cyber capability, though several researchers questioned how much of Anthropic’s headline claims can yet be verified through public CVEs and warned that similar results may be reproducible with cheaper or open models plus strong tooling. The UK AI Security Institute found Mythos achieved a **73%** success rate on expert capture-the-flag tasks and completed a full 32-step simulated enterprise attack in 3 of 10 runs, while Anthropic later reported coordinated disclosure activity spanning **1,596 vulnerabilities across 281 open-source projects** and partners identifying more than **10,000** high- or critical-severity candidates. Governments, financial regulators, and CISO groups in the US, UK, Europe, Canada, and Japan responded with briefings and warnings that AI is compressing the gap between vulnerability discovery and weaponization, leaving remediation, patch governance, and defensive automation as the main bottlenecks.
Aug 31, 2026