For a long time, applying security upgrades promptly was a critical component of Application Security. One of the first signals I got that something fundamental was changing came at BSides SF last year, where Mackenzie Jackson from Aikido Security demonstrated something genuinely unsettling. He had pointed a large language model at open-source changelogs and asked it to find vulnerabilities that had been "shadow patched": fixed without ever being formally published as a CVE.
This happens more often than you would think. A maintainer fixes a serious security bug, writes something vague in the changelog like "redacted tokens" or "increase encryption work factor," and moves on. The LLM's job was to read that deliberately obfuscating language, figure out what it actually meant, cross-reference it against public CVE databases, and flag the gaps. Because these were never published as CVEs, downstream developers had no way of knowing they were running vulnerable versions.
Mackenzie Jackson, BSides SF: Using AI to spot shadow patches in open source software
Over the course of 2024, Aikido's pipeline uncovered more than 500 undisclosed vulnerabilities in open-source packages, and 67% were still undisclosed months after the fix had shipped. Over half of the high and critical ones had never been disclosed at all. These were not obscure libraries: they found undisclosed vulnerabilities in Axios (56 million weekly downloads), Apache's echarts, Chainlit. Remote code execution was the most common category among the critical findings.
"We have to assume that the bad guys have done this too, and that they can find and exploit these vulnerabilities before organizations patch them."
Mackenzie Jackson
From reading about bugs to actually finding them
Aikido's work was clever, but it operated within a defined boundary. The LLMs were not discovering new vulnerabilities so much as surfacing ones that humans had already found and fixed but neglected to disclose. The model was a very sophisticated reader of commit diffs and release notes.
That boundary did not last long. In October 2025, OpenAI unveiled Aardvark, an autonomous security agent built on GPT-5. Aardvark did not just read changelogs. It read actual source code, analyzed entire repositories, built threat models from scratch, scanned incoming commits for security implications, and then attempted to exploit what it found in a sandboxed environment to confirm the vulnerability was real. In benchmark testing it identified 92% of known and synthetically introduced vulnerabilities, and it had already earned ten CVE identifiers from bugs it found in open-source projects on its own.
This was a qualitative shift: the LLM was no longer a passive reader spotting what humans had missed disclosing. It was an active hunter finding what humans had missed entirely, doing the full loop from discovery through exploitation through patch generation without a human in the chair. Aardvark, by every subsequent measure, turned out to be a modest preview of what was coming.
The vulnerability avalanche
In 2024 alone, over 40,000 CVEs were reported, already overwhelming security teams worldwide. The time between disclosure and exploitation had been compressing for years, and the window defenders relied on was narrowing toward zero. But all of that assumed the bottleneck was on the discovery side: vulnerabilities were hard to find, expensive to analyze, and required deep human expertise to weaponize. Remove that bottleneck by handing the job to a model that can read millions of lines of code in minutes and reason about memory corruption, type confusion, and race conditions, and the math changes in a way that does not have a gentle term for it.
Open source was particularly exposed. We all remember Log4j in 2021: a single critical library maintained by a handful of volunteers, buried four layers deep in the dependency tree, turned out to be the load-bearing wall for half the internet. But Log4j was found by a human researcher at Alibaba who happened to notice something odd. The question now on the table was: what happens when models can systematically audit every package on PyPI, npm, and crates.io in parallel, around the clock?
Mythos and Project Glasswing
On April 7, 2026, Anthropic published something that read less like a product announcement (which it was!) and more like a threat briefing.
Project Glasswing brought together AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks around a single premise: AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities, and the clock is ticking before those capabilities proliferate beyond responsible actors.
At the center of the announcement was Claude Mythos Preview, an unreleased frontier model that had discovered thousands of zero-day vulnerabilities, including some in every major operating system and every major web browser. Not shadow patches in changelogs, not synthetic bugs in benchmark repos, but real, previously unknown, exploitable flaws in the software that runs the actual world.
A few of the disclosed examples: Mythos found a 27-year-old vulnerability in OpenBSD, an OS whose entire reputation is built around being security-hardened, that allowed an attacker to remotely crash any machine just by connecting to it. It found a 16-year-old bug in FFmpeg in a line of code that automated testing tools had hit five million times without catching. It independently discovered and chained together multiple Linux kernel vulnerabilities to escalate from ordinary user access to full system control. These are the kinds of bugs that win Pwn2Own competitions and command six-figure bounties. The model found them autonomously.
On the CyberGym benchmark for vulnerability reproduction, Mythos scored 83.1% compared to Opus 4.6's 66.6%. On SWE-bench Verified it hit 93.9%. Anthropic is not making Mythos Preview generally available. Instead it is being provided to launch partners and over 40 organizations that build or maintain critical software infrastructure, backed by up to $100 million in usage credits and $4 million in direct donations to open-source security organizations. The operational focus is defensive: vulnerability detection, black-box testing, endpoint security, penetration testing.
The dual-use problem
Every capability that makes Mythos valuable to defenders (the ability to reason about code semantics, chain together subtle bugs across subsystems, generate working exploits) is exactly what makes it valuable to attackers. The only real question is who gets there first.
Anthropic was explicit about this, noting that it will not be long before such capabilities proliferate beyond responsible actors and that the fallout for economies, public safety, and national security could be severe. CrowdStrike's CTO Elia Zaitsev put it more directly: the window between a vulnerability being discovered and being exploited has collapsed from months to minutes with AI, and that is not a reason to slow down but a reason to move together, faster.
The trajectory from BSides SF 2025 to Project Glasswing is a story in three parts of a future that arrived faster than anyone expected. First, LLMs learned to read what humans had written about bugs. Then they learned to find bugs that humans had missed entirely. Then they got better at it than all but the very best humans alive.
The old model of human-paced vulnerability research, disclosure, and patching cannot survive contact with systems that operate at machine speed and machine scale. The software ecosystem has accumulated decades of technical debt, patching at scale remains painful, and attackers only need to find one bug while defenders need to find all of them.
Or, if you are a glass half-full kind of person: