GoKawiilAnthropic's Claude Mythos flags 26,000+ bugs, but only 10% reach disclosure
An analysis of Anthropic's public Vulnerability Disclosure Ledger by researcher Patrick Garrity found that Claude Mythos, part of Project Glasswing, has generated 26,153 vulnerability findings since April 2026. Of those, only about 2,736 have entered the disclosure pipeline, roughly 202 have been patched, 245 withdrawn, and 191 await initial reporting to maintainers, leaving nearly 90% of findings unprocessed.
GoKawiil's interpretation of the reporting above, not reported fact.
The gap shows that the real constraint in AI-assisted vulnerability research isn't discovery but human verification and coordination with software maintainers, who must confirm severity and manage fixes. This complicates the narrative that frontier AI models are dramatically accelerating security improvements, since raw detection volume doesn't translate into faster real-world remediation.
- Claude Mythos found 26,153 potential vulnerabilities since April 2026 under Project Glasswing.
- Only about 10% of findings have reached the disclosure ledger, with just 202 actually patched.
- Human validation and maintainer coordination, not AI detection speed, appear to be the main bottleneck.
The Web Application Hacker's Handbook — If the real bottleneck is validating and triaging findings, human expertise is the scarce resource — and this classic remains a go-to reference for learning how to confirm and exploit web flaws properly. It's a solid desk companion for anyone sorting signal from noise in a firehose of AI-generated vulnerability reports.
See The Web Application Hacker's Handbook on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Jai Vijayan, 2026-09-09
Published there as: “Mythos Vulnerability Firehose Hits a Human Bottleneck”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.