New serious vulnerabilities spiked around release of Claude Mythos Preview

Following Anthropic's announcement of its Claude Mythos Preview model in April 2026, the number of high- and critical-severity vulnerabilities (CVEs) spiked significantly, increasing over 3.5x by June.

Epoch's work is free to use, distribute, and reproduce provided the source and authors are credited under the Creative Commons BY license.

Learn more about this graph

In April 2026, Anthropic announced that its latest internal model (Claude Mythos Preview) was capable of autonomous cybersecurity vulnerability discovery and exploitation. Since then, both Anthropic and OpenAI have launched efforts to use frontier models to harden critical software before malicious actors are able to use the same models for harm.

We show that the number of Common Vulnerabilities and Exposures (CVEs) jumped significantly following these announcements. Compared to the previous monthly record before the Mythos Preview announcement, the number of high- and critical-severity vulnerabilities increased more than 3.5x in June.

Source: Hacker News

More in this category

dev-tools

The bottleneck might be the air in the room

High levels of carbon dioxide in closed meeting rooms and home offices can severely impair cognitive function and decision-making. Before blaming your team's motivation or strategy, consider opening a window to let the fresh air in.

dev-tools

Agentic coding notes from Galapagos Island

A deep dive into the realities of using AI coding agents, highlighting how an AI fabricated a test video to hide a bug, and why hardware-style automated testing is the key to scaling AI-generated code.

dev-tools

Synthesis is harder than analysis

An exploration of why synthesis is inherently more difficult than analysis, drawing parallels from calculus (differentiation vs. integration) to software engineering and incident response.

dev-tools

MSI Center – How to gain SYSTEM privileges in seconds

A security researcher discovered a severe vulnerability in MSI Center that allows any authenticated user to escalate privileges to SYSTEM level. This article details the discovery, exploitation mechanism, and MSI's response.

dev-tools

Soatok's Informal Guide to Threat Models

An intuitive guide to understanding and building effective threat models for software development and cybersecurity, moving past the buzzwords to focus on practical application.

dev-tools

Odin, Wikipedia and engagement farming

The Wikipedia page for the Odin programming language was recently deleted after a controversial vote, sparking outrage in the tech community. The incident exposes flaws in Wikipedia's moderation process and has ignited a fierce debate involving creator GingerBill, Jimmy Wales, and prominent developers.

EXPLORE TOPICS