Anthropic's Mythos finds 6,202 critical software flaws

In a 26 May update on Project Glasswing, Anthropic said Claude Mythos Preview scanned more than 1,000 open-source projects and flagged 23,019 issues, of which 6,202 rated high or critical severity. Six independent security firms assessed a sample of 1,752 of those findings; 90.6% (1,587) were valid true positives and 62.4% (1,094) confirmed high/critical — a clean signal, stated as a sample rather than a blanket claim. Concrete examples: a certificate-forgery flaw in wolfSSL (CVE-2026-5194, used by billions of devices, since patched), a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug.

About 50 vetted partners — AWS, Apple, Google, Microsoft, NVIDIA, JPMorgan, Cloudflare, Mozilla and others — have defensive-only access. Their own bug-finding reportedly rose more than tenfold (Cloudflare alone reported ~2,000 bugs; Mozilla found 271 in Firefox 150). Mythos itself stays restricted: the same capability that helps defenders find flaws would help attackers build exploits.

Watch patch velocity, not find counts. The Glasswing vulnerability dataset isn't fully public yet — aggregate numbers and examples only, while patches continue to ship. The durable question: can the repair side scale as fast as the discovery side? Anthropic's OpenSSF partnership and free tooling are a start; the structural under-resourcing of open-source maintenance is the harder, longer-term problem.