Claude Mythos discovers thousands of zero-day vulnerabilities in one month
Claude Mythos Preview, an advanced AI model by Anthropic, identified over 10,000 security vulnerabilities in one month through the Project Glasswing initiative with 50 partner organizations, with open source scans revealing 23,019 total vulnerabilities. The European Central Bank convened banks to address cybersecurity risks from the discoveries, warning that AI can identify new vulnerabilities minutes after patch releases.
What happened
Anthropic announced on April 7, 2026 that Claude Mythos Preview had independently discovered thousands of zero-day vulnerabilities in operating systems, browsers and open source software.
Through Project Glasswing, which provided nearly 50 partner organizations access to Mythos for one month, partners found over 10,000 vulnerabilities. Cloudflare discovered 2,000 weaknesses in critical-path systems including 400 high or critical severity issues; Mozilla found and patched 271 vulnerabilities in Firefox 150, over ten times more than the previous version; Palo Alto Networks patched 26 CVE-numbered vulnerabilities and 75 total weaknesses, five times the previous update rate; Oracle announced monthly routine security updates starting May in response.
Anthropic scanned over 1,000 open source projects and found 23,019 vulnerabilities total, of which 6,202 were high or critical severity. Six security companies working with Anthropic verified 1,752 high or critical vulnerabilities, confirming 1,587 (90.6 percent) were valid and 1,094 (62.4 percent) were confirmed high or critical severity.
Reported impact
The European Central Bank convened a meeting on financial system cybersecurity risks to address potential threats from Mythos. ECB Executive Board member Frank Elderson warned that banks must quickly deploy security patches, as AI can identify vulnerabilities within minutes of patch release.
Elderson stated that limited access to Mythos technology by European banks had raised concerns in the European financial sector, and requested that American banks using the model share findings with unable European counterparts.
Index analysis
The discovery of vulnerabilities by Mythos demonstrates the model's capability to autonomously identify zero-day flaws across major software systems at scale. The false positive rate was reported to be lower than human testers.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.