Anthropic has released initial results from testing the beta version of its AI model, Mythos, which significantly enhances capabilities for error detection, vulnerability identification, and creating ready-made exploits. Using the AI model Mythos, the company scanned over a thousand important open-source projects, uncovering 23,019 vulnerabilities. Among them, 6,202 vulnerabilities were assigned a high or critical level of severity.
Out of the 6,202 vulnerabilities classified as dangerous by the AI model Mythos, 1,752 were verified by independent companies specializing in cybersecurity. In 1,587 cases (90.6%), the existence of the vulnerability was confirmed, and in 1,094 (62.4%), a high or critical level of severity remained. With the current false positive rates, it is estimated that out of the 6,202 dangerous vulnerabilities reported by the AI model, approximately 3,900 (62.4%) will retain the selected high severity level, excluding dangerous vulnerabilities found separately during audits by 50 participants of the Glasswing project.
Details on 467 verified vulnerabilities were provided to the maintainers of the open-source projects by representatives of the reviewing companies. Upon specific requests, Anthropic staff directly communicated information about 1,129 unverified issues to the maintainers. In total, the maintainers of 281 open-source projects received information about 1,596 issues and confirmed the presence of 1,451 vulnerabilities. However, only 97 issues have been fixed in the codebases so far, and 88 public reports on vulnerabilities have been released.
Additionally, it is reported that 50 participants of the Glasswing project, who were granted early access to the Mythos model, identified over 10,000 dangerous vulnerabilities in their codebases. For instance, Cloudflare found over 2,000 errors using Mythos, of which 400 were flagged as vulnerabilities with high or critical levels of severity. The false positive rate, according to Cloudflare, was lower than during human testing. Mozilla found 271 vulnerabilities in the Firefox 150 code using Mythos, which is ten times more than was discovered in Firefox 148 by the Claude Opus 4.6 model.
An example of a critical issue that has already been fixed is cited
A vulnerability (CVE-2026-5194) in the cryptographic library wolfSSL. Mythos was able to prepare an exploit that allows an attacker to create a forged ECDSA certificate for websites and emails. servers, which was processed by the wolfSSL library as valid during verification. The issue was caused by the absence of checks for hash size and OID in the code, allowing a hash smaller than acceptable to be specified in the certificate.
Source: opennet.ru
