Mythos uncovers 6,202 critical bugs in major open-source projects
Anthropic's Mythos security agent identified 6,202 high- or critical-severity vulnerabilities across 1,000+ open-source repositories in a one-month pilot, with independent verification confirming 90 percent of findings and a false-positive rate below human testers.
Anthropic released interim results from Mythos and Project Glasswing on May 27, revealing that the AI security agent has identified 6,202 high- or critical-severity vulnerabilities across more than 1,000 widely used open-source repositories. Partners running the tool in private codebases reported hundreds of critical bugs each, with some teams seeing a tenfold increase in detection speed. Cloudflare alone flagged 2,000 issues—400 of them high or critical—and reported fewer false positives from Mythos than from human penetration testers.
Of the 6,202 open-source findings, 1,752 have been independently verified by six third-party security firms. Ninety percent of those checks confirmed real vulnerabilities, and 62 percent (1,100 bugs) retained their original high or critical severity rating. One example: Mythos generated a working exploit against wolfSSL that would allow an attacker to forge certificates, enabling a convincing phishing site that browsers would treat as legitimate with no warning to the user.
