Anthropic Built an AI That Autonomously Found Zero-Day Vulnerabilities in Every Major Operating System and Every Major Browser. Then They Refused to Release It. The Implications for Every Organization That Runs Software Are Immediate.

TL;DR

On April 7, Anthropic announced Claude Mythos Preview, its most advanced frontier AI model. During internal testing, the model autonomously discovered and exploited zero-day vulnerabilities in every major operating system and every major web browser, along with critical flaws in other widely deployed software. Rather than releasing the model publicly, Anthropic launched Project Glasswing, a restricted defensive initiative backed by $100 million in usage credits, partnering with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Over 99% of the discovered vulnerabilities remained unpatched at the time of announcement. Cybersecurity experts are calling this the most significant shift in vulnerability research since Google's Project Zero launched in 2014.

The takeaway

Palo Alto Networks warned that similar AI capabilities are weeks or months from proliferation.

1000s

Zero-days discovered

27 yrs

Oldest bug found (OpenBSD)

$100M

Glasswing commitment

99%+

Still unpatched at announcement

WHAT ANTHROPIC BUILT

Claude Mythos Preview represents what Anthropic describes as a "step change" over its predecessor. During internal red team testing, the model did not just find vulnerabilities. It autonomously discovered zero-day flaws across every major operating system and every major web browser, then constructed working exploits without human direction. The model surpassed all but the most skilled human vulnerability researchers in both speed and coverage.

Among the disclosed findings: a 27-year-old crash bug in OpenBSD (a system specifically designed for security), a 16-year-old vulnerability in FFmpeg's H.264 codec (used by billions of devices for video playback), and a guest-to-host memory corruption vulnerability in a production virtual machine monitor. Three vulnerabilities were disclosed publicly after being patched. Thousands more remain under coordinated disclosure.

Anthropic's Frontier Red Team Cyber Lead, Newton Cheng, told VentureBeat directly: "We do not plan to make Claude Mythos Preview generally available due to its cybersecurity capabilities." This is the first time a major AI company has built a frontier model and explicitly refused to release it because the offensive security implications were too severe.

PROJECT GLASSWING

Instead of releasing Mythos publicly, Anthropic launched Project Glasswing on the same day. The initiative provides restricted access to Mythos Preview for defensive vulnerability scanning, backed by $100 million in Anthropic compute credits. The founding partner list reads like the critical infrastructure of the global technology stack: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks.

Beyond the founding partners, Anthropic extended access to more than 40 additional organizations that build or maintain critical software. The objective is to find and patch the discovered vulnerabilities before hostile actors develop AI systems with comparable capabilities. Palo Alto Networks' Wendi Whitmore warned publicly that similar capabilities are "weeks or months from proliferation."

The urgency is not theoretical. CrowdStrike's 2026 Global Threat Report puts average eCrime breakout time at 29 minutes. Mandiant's M-Trends 2026 report shows adversary hand-off times have collapsed to 22 seconds. Offense was already getting faster before AI entered the equation. Mythos represents a capability that can discover vulnerabilities at a speed and scale that human researchers cannot match, and the defensive community is now racing to patch thousands of flaws before that capability is replicated by actors who will not exercise the same restraint Anthropic did.

WHY THIS CHANGES EVERYTHING

The cybersecurity industry has operated for decades on the assumption that finding zero-day vulnerabilities is hard. It requires specialized human expertise, significant time investment, and deep knowledge of specific codebases. The entire economics of vulnerability research, bug bounty programs, and defensive patching cycles are built on this assumption.

Mythos demolishes that assumption. If an AI model can autonomously discover thousands of zero-days across every major operating system and browser in a testing window, the scarcity of zero-day discovery is no longer a meaningful defensive barrier. The question shifts from "how likely is it that an attacker finds a zero-day in our software" to "how quickly can we patch the zero-days that AI systems are about to surface at industrial scale."

This has cascading implications. Vulnerability disclosure timelines built for human-scale discovery do not work when AI can produce thousands of findings per testing cycle. Patch prioritization frameworks built around "likelihood of exploitation" become irrelevant when exploitation is automated. Security staffing models built around human analyst capacity cannot keep pace with AI-generated vulnerability volume. Over 99% of Mythos' findings were still unpatched at the time of the April 7 announcement. That number tells you everything about the gap between AI discovery speed and human remediation capacity.

THE OFFENSIVE SCENARIO

Anthropic chose not to release Mythos publicly. That decision buys time. It does not buy safety. The capability exists. Other AI labs are building comparable models. State-sponsored threat actors with sufficient compute resources are almost certainly pursuing the same capability. And unlike Anthropic, threat actors operating from Russia, China, North Korea, or Iran are not going to launch a $100 million defensive partnership before using what they find.

The window between Anthropic's responsible restriction and the proliferation of comparable offensive AI capabilities is the most important period in cybersecurity since the discovery of the first network worm. What organizations do in this window determines whether they are defensible when AI-powered vulnerability discovery becomes a commodity tool for attackers.

WHAT THIS MEANS RIGHT NOW

1
Patch velocity is now the single most important security metric. If AI can find zero-days at industrial scale and offensive breakout times are measured in minutes, the time between patch release and patch application is the window attackers will exploit. Reduce that window to hours, not days or weeks.
2
Assume your current software has zero-day vulnerabilities that have not been discovered by human researchers. Mythos found a 27-year-old bug in OpenBSD. If security-focused software carries vulnerabilities for decades, every production system you run has undiscovered flaws. Defense in depth, network segmentation, and monitoring for post-exploitation behavior are more important than ever.
3
Review your organization's exposure to the software Mythos tested. Every major operating system and every major browser means Windows, macOS, Linux, Chrome, Firefox, Safari, and Edge are all in scope. If Glasswing partners are patching vulnerabilities discovered by Mythos over the coming months, expect an elevated volume of critical patches. Prepare your patching infrastructure for sustained high throughput.
4
For organizations operating critical infrastructure, understand that AI-powered offensive capabilities will reach threat actors who target your sector. The Iran PLC advisory we covered on April 9 documented active targeting of water systems, power grids, and government facilities. When state-sponsored actors gain AI vulnerability discovery capabilities, the attack surface against critical infrastructure expands dramatically.
5
Invest in detection and response capabilities, not just prevention. When zero-day discovery becomes automated, prevention alone is insufficient. The ability to detect exploitation attempts and respond before an attacker achieves their objective becomes the primary defensive layer.

ATARUS ASSESSMENT

Anthropic did the responsible thing by restricting Mythos and launching a defensive initiative before releasing offensive capabilities into the wild. That decision deserves recognition. But it also confirms what security practitioners have feared: AI has reached the point where it can autonomously discover and exploit vulnerabilities at a scale and speed that makes human-only defense unsustainable. The 99% unpatched figure at announcement is the critical number. It means the defensive community is already behind, and AI-powered vulnerability discovery has only just started. Every organization needs to treat the next 12 months as a window to fundamentally improve patch velocity, detection capability, and defense in depth before AI-powered offense becomes widely available. The supply chain attacks we have covered all month, the CISA budget cuts, the Iran PLC targeting, and now AI-automated vulnerability discovery, are not separate stories. They are converging pressures on a defensive ecosystem that is already strained. The organizations that survive this convergence will be the ones that treated 2026 as the year the threat landscape structurally changed.