Anthropic's Mythos AI Finds New Bugs Fast. Your Old Unpatched Ones Are Still the Real Danger.

Key points

• Anthropic launched Mythos, an AI system that automatically hunts for software security flaws, on 7 April 2025.
• Mythos files discovered flaws as CVEs (Common Vulnerabilities and Exposures), the unique ID numbers that catalogue every known software bug so vendors and defenders can discuss the same problem.
• Exploit code, software that turns a known flaw into a working attack, now appears within 3 to 7 days of a bug being made public.
• Most organisations take 45 days or more to apply a critical patch, leaving a roughly six-week window where attackers can walk straight in.
• Measuring the gap between when a vendor releases a patch and when it lands on every affected system is the single most important metric most companies aren't tracking.

Anthropic, the company behind the Claude family of AI assistants, unveiled a tool called Mythos on 7 April 2025. As first reported by ThreatVectr, Mythos reads software code the way a human security researcher would, only far faster, and it automatically files what it finds as CVEs. The security industry promptly started worrying about the flood of new entries pouring into an already overloaded catalogue.

That worry is real. It's also the wrong thing to focus on.

Look at breach reports from the last five years and the same pattern appears. Attackers didn't find a clever zero-day, meaning a flaw nobody knew about yet. They walked in through a flaw the vendor had already patched, sometimes months before the attack, that the victim simply hadn't gotten around to fixing.

Does Mythos actually make companies less safe?

Not directly. But it makes a pre-existing problem harder to ignore. Here's the arithmetic: if your organisation takes 45 days on average to apply a critical patch, and working exploit code for a new bug appears within 3 to 7 days of disclosure, you're exposed for close to six weeks on every serious flaw. Mythos speeds up the discovery side of that equation. It does nothing about the delay on the other side.

For ordinary people, this matters practically. The companies holding your medical records, your bank details, your shopping history: their security depends not just on finding bugs but on fixing the ones they already know about. A smarter discovery tool is only useful if the patching process behind it can keep up. We looked at this dynamic from a different angle when covering Google's Gemini 3.5 Flash security work on 21 July 2026, where rapid AI-driven discovery raised the same question about whether defenders could absorb the volume.

Four things stand out for defenders.

First, measure the patching window. Not the total count of open CVEs in a queue. The number of days between a vendor releasing a fix and that fix reaching every affected system, sorted by severity. If that number doesn't exist today, producing it is the first project.

Second, shrink it. A 30-day deadline for critical patches is no longer aggressive; it's the minimum. For flaws with working exploit code already circulating, seven days is a more defensible target.

Third, build an accurate asset inventory, a complete list of every machine and service the organisation actually runs. Every incident responder has the same story: the forgotten server in a back room, the acquired company's systems nobody mapped. Mythos-scale discovery will find those machines before any patching team does.

Fourth, read vendor security advisories on the day they publish and act on them. If a critical fix requires a committee meeting before it ships, the committee process is itself the vulnerability.

Mythos didn't break anyone's security programme. It made the clock run faster. Whether that matters depends entirely on how long the window has been open already.