Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software

Summary: Anthropic disclosed that Project Glasswing, its defensive initiative giving about 50 partners early access to the Claude Mythos Preview model, has surfaced more than 10,000 high- or critical-severity vulnerabilities in systemically important software since launching last month. Of 6,202 high- or critical-severity candidates affecting over 1,000 open-source projects, analysis confirmed 1,726 true positives and 1,094 high- or critical-severity flaws, including a CVSS 9.1 certificate-forging flaw in WolfSSL (CVE-2026-5194), with 97 findings patched upstream and 88 advisories issued.
Why it matters: Anthropic's own framing is the stake: finding vulnerabilities has become easy relative to fixing them, and only 97 of the confirmed findings have been patched upstream so far - so a large share of the 1,094 high- or critical-severity flaws may still be unpatched in code you depend on.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-5194
Related: ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026