Anthropic's Claude Mythos discovers thousands of zero-day vulnerabilities

Thousands. Not dozens. Not hundreds. Thousands of zero-days, and Anthropic's locked this thing behind a velvet rope with 40 companies. That's the right call — and it's also terrifying that they had to make it.

Here's the thing: we've spent years arguing about whether AI can actually reason about code. Mythos just answered that. It found vulnerabilities at a scale no human team could — and it didn't need a CVE database to start from.

The Project Glasswing wrapper is doing a lot of work here. Anthropic knows what they built. You don't restrict a model this hard unless you've watched it do something that keeps you up at night. (I'd genuinely like to know what the internal red-teaming looked like.)

For us building on the web? Honestly, this shifts the threat model. Assume attackers will have access to something similar within 18 months. Your auth flows, your API boundaries, your dependency choices — all of it needs to survive a model that thinks like this.

The good news: defenders get it first. For now.