A month of real-world testing by main firms is giving us a greater concept of Anthropic’s Mythos frontier LLM’s capabilities in safety. The corporate’s replace, which comes a month after the preliminary launch of Venture Glasswing, suggests the mannequin is surfacing actual vulnerabilities at scale whereas additionally highlighting ongoing challenges round noise and belief in its output.
In whole, Anthropic says Mythos has scanned greater than 1,000 open supply software program tasks and recognized 6,202 bugs it classifies as excessive or crucial severity. That makes the mannequin some of the distinguished examples but of AI getting used to hunt for flaws in dwell codebases, particularly in security-sensitive open supply software program.
However the headline is not only about quantity. It is usually about reliability. The newest findings level to a system that may clearly discover points however nonetheless produces hallucinations and false positives. Though the false optimistic price stays inside regular business ranges, Mythos’ capacity to uncover multi-step assaults means the time required for investigation can rapidly compound.
What the Replace Says
In keeping with Anthropic, Mythos handed 28% of the excessive or crucial severity findings, or 1,752 bugs, to 6 impartial safety analysis companies for evaluation. These companies discovered a 9.4% false optimistic price and confirmed 62.4% of the bugs as genuinely excessive or crucial severity.
Anthropic additionally mentioned it has to date disclosed 530 of the bugs to open supply maintainers and hopes to reveal one other 827 as rapidly as attainable. Of the 530 already reported, 75 have been patched and 65 have obtained public advisories. Anthropic mentioned the patch price displays a broader downside within the safety ecosystem, noting that even with a comparatively sluggish disclosure tempo, Mythos Preview is including strain to an already overloaded system.
One instance Anthropic highlighted was a crucial WolfSSL vulnerability, CVE-2026-5194, which it rated CVSS 9.1. The corporate mentioned the bug might permit certificates forgery, underscoring the form of high-stakes concern the mannequin can floor when it really works as meant.
Why the Outcomes Matter
Mythos has generated each pleasure and concern as a result of it seems able to chaining collectively a number of steps in an assault in methods earlier AI techniques couldn’t. That raises the stakes. A mannequin that may transfer from one weak spot to a different and assemble a proof of idea is not only a scanner. It’s nearer to an lively safety analyst and doubtlessly a robust offensive instrument as nicely.
That’s one purpose Anthropic has not launched the mannequin publicly. As an alternative, it has restricted entry to a small group of firms by way of Venture Glasswing, a managed program designed to check the mannequin in actual safety environments. The method lets Anthropic collect suggestions whereas decreasing the danger of the system being misused at scale.
The early reception has been largely optimistic. Taking part firms have reportedly discovered 1000’s of high-severity flaws, together with bugs affecting main working techniques and in style net browsers. That means Mythos can ship actual worth to defenders, particularly when paired with robust triage and human evaluation.
Nonetheless, the most recent replace complicates the image. A 9.4% false optimistic price isn’t excessive by business requirements, however as a result of Mythos is discovering 1000’s of bugs, absolutely the variety of false positives can nonetheless create important operational friction.
What Comes Subsequent
Cloudflare’s Chief Safety Officer, Grant Bourzikas, mentioned Mythos represents “a transparent enchancment” over earlier fashions, however he additionally warned that hallucinations and false positives stay an ongoing problem:
“Ask a mannequin to seek out bugs, and it’ll discover them, whether or not the code has any or not. Findings come again hedged with ‘probably,’ ‘doubtlessly,’ and ‘might in idea,’ and the hedged findings vastly outnumber the strong ones. That’s an inexpensive bias for an exploratory instrument. It’s a ruinous one for a triage queue.”
His level was that the mannequin could also be higher at producing helpful output, however it’s nonetheless probabilistic, which means the identical request can yield completely different outcomes relying on how and when it’s requested.
That inconsistency issues as a result of safety groups want dependable triage, not simply fascinating findings. If a mannequin produces too many hedged or unsure outcomes, it could actually sluggish the very groups it’s meant to assist. As Bourzikas famous, quicker scanning alone doesn’t resolve the deeper downside as a result of patching nonetheless depends upon testing, validation, and secure deployment.
Anthropic can be attempting to strengthen the broader ecosystem across the mannequin. It has partnered with the Open Supply Safety Basis’s Alpha-Omega undertaking to assist OSS groups triage bug studies, whereas different companions comparable to Cisco are open-sourcing associated safety frameworks.
For now, Mythos seems like a robust sign that frontier fashions can materially change software program safety. However the replace additionally exhibits the boundaries of that promise. The tougher half will not be discovering bugs, however proving which of them matter and fixing them with out creating new issues within the course of.
