Anthropic's AI found thousands of security bugs — explained

A large proportion of the world's software is built on free, 'open-source' code — code that anyone can read, use and contribute to, often maintained by small teams of volunteers rather than paid corporate engineers. Anthropic pointed a powerful AI at some of that code and found thousands of serious problems that had been hiding there for years. Here's what happened, in plain English, and what it means for you.

Mythos scanned more than 1,000 open-source projects and flagged 23,019 potential issues in total. Of those, 6,202 were rated as serious — meaning high or critical severity, the kind that could let an attacker break into a system, steal data, or impersonate someone. To make sure the AI wasn't just making things up, Anthropic took a sample of 1,752 of the serious findings and had six independent security firms check them carefully. About 90.6% of that sample — roughly 9 in 10 — turned out to be genuine real problems, not false alarms. It's worth being precise here: that 9-in-10 figure comes from the carefully-checked sample, not from every single flaw, but even so it's a very high accuracy rate for an automated tool.

One concrete example: a serious flaw was found in a piece of software called wolfSSL, a library that handles secure connections on billions of devices — think the kind of encryption that protects your bank app or your smart home device. Mythos even showed how an attacker could use it to forge a security certificate and impersonate a real bank's website. That specific flaw (catalogued as CVE-2026-5194) has now been fixed, following responsible disclosure by Anthropic's team. Other examples were astonishingly old: a bug hiding in OpenBSD for 27 years, and one in the FFmpeg video software for 16 years. These are components that quietly run behind the scenes in many of the apps and services people use every day.

Anthropic didn't release Mythos to everyone. Instead, it gave roughly 50 carefully chosen organisations — including big names like Apple, Google, Microsoft, AWS, NVIDIA, and JPMorgan — early access for defensive security work only. These partners are using Mythos to find flaws in software before attackers do. The results speak for themselves: the partners' own bug-finding output reportedly went up more than tenfold after getting access.

Why so restricted? Because the same AI that helps a defender find a security flaw could theoretically help an attacker exploit one. Anthropic is keeping Mythos locked down to trusted partners while it works on stronger safeguards — the intention is to eventually make Mythos-class AI more widely available, but only once that framework is in place. Until then, it's defensive-only, with vetted access.

Here's the harder truth. Anthropic's own update acknowledged it plainly: AI can now find these problems much faster than people can fix them. A lot of the open-source software the world relies on is maintained by small volunteer teams who are already stretched. When an AI tool can identify thousands of serious flaws in a short time, the bottleneck isn't finding the problems — it's having enough people, time and resources to actually patch them.

The honest answer is: probably not much to worry about in the short term, but it matters for the longer term. These security flaws already existed before Mythos found them — the AI didn't create new problems, it just revealed ones that were already there. Most are being disclosed responsibly and patched before attackers can exploit them. The most important thing you can do is keep your devices and software updated, because updates are how the patches reach you. Longer term, programmes like Glasswing represent a genuine shift in how the industry finds and fixes security problems — and one that, done carefully, makes the software you use a bit safer over time.