The problem isn’t that AI can find vulnerabilities. Anthropic’s Claude Mythos Preview discovered thousands in scans of open-source software, surfacing decades-old flaws that survived human review: a 27-year-old OpenBSD bug, a 16-year-old FFmpeg vulnerability. In 1,000 repositories, it identified over 23,000 issues, 6,202 rated high or critical. Mythos can autonomously chain multiple vulnerabilities into working exploits.
The real problem is validation pace. In H1 2026, 35,853 CVEs were published, a 49% surge from the prior year. Yet only 495 made it into CISA’s catalog of actively exploited vulnerabilities. Just 116 were under active attack on their disclosure day.
That’s not noise; it’s a structural bottleneck. Security teams triage and patch slower than AI discovers. The validation backlog ran deep before Mythos. Now thousands of candidates per scan get fed into a system that can’t absorb them. Fixing this isn’t about finding better vulnerabilities; it’s about rethinking how teams prioritize and respond at scale.
Sources: Claude Mythos Preview’s Cybersecurity Capabilities • Project Glasswing • CVE Mid-Year 2026 Check-In
Coverage: AI Changed the Exposure Problem. Validation Needs to Change With It.
Related on this blog: [AUTO] AI-Generated Patches Fail at Scale • [AUTO] Langflow RCE Added to KEV After a Month of Silence • [AUTO] When your AI agent decides unauthorized access is a reasonable tactic