Most of the bugs Claude Mythos found have never been checked by a human
Anthropic pointed Claude Mythos Preview at 281 open-source projects and collected 23,019 candidate vulnerabilities. External security firms reviewed 1,900 of them. Maintainers received 1,596 reports and acknowledged 1,451; 97 fixes landed upstream, and 88 findings became published security advisories, with counts current as of May 22, 2026. The other 21,119 candidates have not been reviewed by anyone outside Anthropic.
Anthropic puts the drop-off down to a shortage of people to check the work, and the slice that did get checked backs that up: 1,726 of the 1,900, or 90.8%, held up as real vulnerabilities. Echo, the software supply chain company that pulled these figures together, attaches a caveat. The 1,900 that went out for review were unlikely to be a random draw from the pile, so 90.8% may be telling you how good the best candidates were and little else. Anthropic has not published the accuracy of the other 21,000.
The severity ratings did not survive review
Twenty-seven of the 88 advisories have been assigned CVEs. Mythos rated eight of those Critical, 15 High and four Medium, and none Low. Independent CVSS scoring and the affected maintainers produced a different distribution: one Critical, 16 High, eight Medium and two Low. One of the eight Critical ratings held.
Two downgrades show what the model could not see. For Temporal Server, Mythos assigned Critical and described an attacker controlling workflows across namespaces. Temporal’s maintainers scored the issue 2.3, Low, because exploitation requires an attacker-controlled namespace that already holds a privileged internal credential, and the impact reaches only known workflows. With MinIO, Mythos again said Critical, an outside security firm said High, and MinIO settled on Medium: the attack needs an existing cluster root JWT and permits read access only. Severity turns on deployment assumptions, privilege boundaries and attack preconditions, and those are hard to read off source code.
Findings that arrive pre-rated are triage input for a security team. Across the 27, 14 carried a severity mismatch, 13 of them overstated and one, a flaw in the jq command-line JSON tool, understated. A queue sorted by the model’s own ratings would have put work at the top that did not belong there.
The exploit jump is real and narrower than it sounds
Anthropic built a benchmark from 50 previously discovered vulnerabilities in the SpiderMonkey JavaScript engine that ships in Firefox 147, then gave each model five attempts per vulnerability, 250 trials in all. Claude Mythos Preview turned a known crash into a working arbitrary code execution exploit in 181 trials, or 72.4%, and reached partial register control in 29 more.
Claude Opus 4.6 managed two, a success rate below 1%. That is the roughly 90-fold jump between model generations, and three conditions travel with it: every trial starts from a crash someone already found, the harness strips out Firefox’s browser sandbox and other defense-in-depth protections, and Anthropic designed and ran the evaluation, which has not been independently replicated.
Cost moved as well. Anthropic turned a known Linux kernel use-after-free into a working root exploit for less than $2,000 in inference and under a day of runtime, chaining it with a second use-after-free it found in the kernel’s traffic-control scheduler. Finding a vulnerability worth acting on still costs a few thousand dollars, with no guarantee the result is a high- or critical-severity flaw.
Echo surveyed more than 80 senior US security leaders in July 2026. In that survey, 37% named detecting more vulnerabilities than they can remediate as the biggest barrier to improving software supply chain security, and 11% said more detection or scanning would be their next investment. Anthropic has manually confirmed further vulnerabilities that it has not sent to maintainers, because its own team and its external partners lack the review capacity to handle them.
