Anthropic's Claude Mythos AI Model Identifies 23,000 Potential Vulnerabilities in 1,000+ Open Source Projects

Anthropic's Claude Mythos AI model has identified over 23,000 potential vulnerabilities across 1,000+ open-source projects, highlighting significant software supply chain risks. External firms have confirmed 1,726 flaws, with over 1,000 rated high or critical. The discoveries include a 27-year-old bug in OpenBSD, demonstrating AI's power to find long-hidden security issues at scale. Access to the tool remains limited due to misuse concerns.

Claims

• ▪As of late May 2026, 75 issues with a critical or high severity rating discovered by Mythos have been patched by vendors.
• ▪The confirmation rate of Mythos's findings is approximately 7.5%, considered high for automated scanning at such a large scale.
• ▪Anthropic is limiting access to Mythos Preview to roughly 50 organizations through 'Project Glasswing' to prevent potential misuse.
• ▪Attackers increasingly target weaknesses in open source software to compromise multiple organizations through a single shared dependency.
• ▪More than 1,000 of the confirmed vulnerabilities were rated as 'high' or 'critical' severity.
• ▪The Mythos model discovered a flaw in the OpenBSD operating system that had remained undetected for 27 years.
• ▪The findings highlight how rapidly expanding software supply chains are creating broader attack surfaces for organizations.
• ▪External security firms have confirmed 1,726 of the flagged issues as genuine vulnerabilities.
• ▪The Mythos AI model scanned more than 1,000 open source software (OSS) projects.
• ▪Anthropic attributes the low number of patches to its 90-day disclosure window, undercounting, and an already overloaded security ecosystem.
• ▪Industries including healthcare, finance, manufacturing, and government increasingly rely on open source software components.
• ▪The Mythos model uncovered security issues across every major operating system and web browser included in its scan.
• ▪AI-driven security systems can scan large volumes of code to identify weaknesses at a scale not possible for human teams alone.
• ▪In contrast to other projects, the Mythos model found only one low-severity vulnerability in the open source tool Curl.
• ▪Using the Mythos model, Mozilla reported finding 271 vulnerabilities in its Firefox browser.
• ▪The majority of cryptocurrency infrastructure, including node clients, wallets, and exchanges, is built on open source software.
• ▪Anthropic's Claude Mythos AI model identified approximately 23,000 potential vulnerabilities in open source software.

3 sources