Anthropic's Mythos Model Discovers Security Vulnerabilities Faster Than Teams Can Patch

Anthropic's Claude Mythos model has been deployed under Project Glasswing to find software vulnerabilities in critical systems at a rate that has outpaced human patching teams [1]. Microsoft was an early partner, holding emergency cross-team engineering meetings to address the volume of Mythos-discovered flaws [1]; by May 2026, Mythos had reportedly identified over 10,000 software vulnerabilities [2]. In a separate research session, Mythos autonomously found mathematical weaknesses in the HAWK post-quantum signature standard and a reduced-round version of AES-128 over 60 hours at approximately $100,000 in API costs [4]. Anthropic frames the program as a race to fix flaws before adversarial governments deploy equivalent tools [1].

The core tension is that AI-driven vulnerability discovery at scale benefits defenders and attackers symmetrically — the same capability that lets Anthropic find and fix thousands of flaws also signals that adversarial governments should be building identical tools [1]. The cryptographic findings, while currently impractical, show Mythos can perform genuine mathematical research rather than pattern-match on known vulnerability types, which extends the potential scope of AI-assisted attack surface analysis [4].

Anthropic's Claude Mythos model has become the center of a significant AI-assisted security research program. Under Project Glasswing, Anthropic gave select software organizations access to Mythos with the explicit goal of finding and fixing vulnerabilities before hackers and adversarial governments — China is specifically named — could exploit similar AI tools [1]. Microsoft was among the first partners; the company convened emergency cross-team engineering meetings to handle vulnerabilities Mythos was uncovering faster than their teams could patch [1]. By May 2026, Mythos had reportedly identified over 10,000 software flaws [2], and Microsoft's Security Response Center published a blog describing how it was adapting processes to work with AI-driven discovery at scale [3].

In parallel, Anthropic researchers ran Mythos in a focused 60-hour cryptographic research session that found mathematical weaknesses in the HAWK post-quantum signature standard and a reduced-round version of AES-128 [4]. The session cost approximately $100,000 in API fees. Crucially, the primary human interventions were motivational rather than technical: researchers repeatedly prompted the model not to give up when it concluded problems were unsolvable, urging it to find something worth publishing [4]. The discovered weaknesses have no practical impact on current systems, but the session demonstrated that Mythos can reach genuine mathematical analysis — not just pattern-matching on known vulnerability classes [4][5].

The ProPublica and Ars Technica investigation into the Microsoft partnership surfaced internal tension: at least one Microsoft engineer asked whether Mythos 'lived up to the hype that Anthropic claimed it would have had,' suggesting the model's performance was not uniformly viewed as a success inside the company [1]. The dual-use dimension runs through the entire program — the same capability that lets defenders find and fix vulnerabilities at scale is one that, in adversarial hands, could accelerate exploitation faster than any human-staffed security team could respond.