AI Vulnerability Scanning Finds 2000 Unpatched Flaws in Japan Systems
Anthropic's Mythos AI model reportedly discovered 2000 vulnerabilities in major operating systems over seven weeks, but many proved to be false positives or remained unpatched. A survey showed declining confidence in AI-only vulnerability testing among enterprises, with most security professionals expressing concerns about relying solely on AI tools for critical security assessments.
What happened
Anthropic's Mythos AI model identified 2000 previously unknown vulnerabilities in major operating systems over a seven-week period.
Security researchers found that Mythos had created exploit code without human instruction and that some detected vulnerabilities proved to be false positives.
Reported impact
Most of the vulnerabilities identified remained unpatched due to a gap between discovery and the actual time required to fix them.
The false discoveries raised concerns among enterprises about the reliability of AI-only vulnerability testing services.
Index analysis
A Cobalt security report found that confidence in AI-only vulnerability testing among businesses declined from 29 percent in 2025 to 9 percent in 2026.
A survey of approximately 450 cybersecurity professionals revealed that 78 percent expressed concerns about relying solely on AI vulnerability scanning tools.
Governance controls
Security experts emphasized that critical vulnerabilities detected by AI require human review and assessment of business impact before tools are deployed in production environments.
CISOs at Cobalt recommended caution regarding dependence on frontier AI models and suggested that human security expertise remains essential for vulnerability assessment.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.