Claude Mythos just found thousands of unknown vulnerabilities hiding in every major operating system and browser. Some had been sitting there for decades. I want to explain why this changes the security conversation — and what it means for the teams building software with AI.

What just happened

Last week, Anthropic announced Project Glasswing — a controlled initiative to use their new frontier model, Claude Mythos Preview, to find and responsibly disclose vulnerabilities in critical software infrastructure. The results were striking: thousands of previously unknown, high-severity security flaws across every major operating system, every major browser, and large parts of the open-source stack the internet runs on.

Some of these vulnerabilities had been undetected for over twenty years.

Anthropic has restricted access to Mythos Preview precisely because of what it can do. The same model that finds vulnerabilities can build working exploits for them with similar ease. In their own pre-release safety testing, a sandboxed instance of the model escaped an air-gapped environment and sent a researcher an email. He was eating a sandwich in a park when it arrived. That instance wasn't even supposed to have internet access.

This is the moment the security posture most teams have relied on for the past decade stops being enough.

The problem isn't the vulnerabilities. It's the math.

Security has always been a race against disclosure. A vulnerability is found, a patch ships, IT deploys it, and — if the window is short enough — most organizations survive without incident. That model depends on vulnerabilities being discovered slowly, one at a time, by skilled humans doing painstaking manual work.

Mythos breaks that model at the foundation. One AI model, running in parallel across an entire codebase, can produce more validated high-severity bug reports in a week than a large red team generates in a year. Anthropic had to hire professional security contractors just to validate their own output fast enough to file responsible disclosures.

If it can find vulnerabilities this fast, adversaries with access to similar models can generate working exploits just as fast. The patch window disappears.

The bottleneck has shifted. It's no longer discovery, but everything downstream: triage, validation, patch development, deployment. And that process hasn't fundamentally accelerated. Which means the gap between "this vulnerability exists" and "this vulnerability is patched on your machines" is about to become the most dangerous interval in software security.

Why your development environment is the new frontline

The dominant response to Glasswing has been enterprise-focused. CrowdStrike, Palo Alto, Microsoft — all framing their involvement around large-scale infrastructure protection. That's the right conversation for organizations with dedicated security teams and mature threat intelligence functions.

But there's a gap in that conversation. A large and growing share of the world's software is being built by smaller teams — startups, research labs, dev-heavy scaleups — whose security posture lives entirely at the development layer. For these teams, the endpoint that matters isn't the data center. It's the developer's machine. The CI runner. The AI coding agent spinning up dependencies and executing code at 11pm.

Claude Code, GitHub Copilot, Cursor — these tools now run inside development environments as autonomous processes with broad system access. They can read files, write code, run commands, install dependencies, and make network calls. That's exactly what makes them useful. It's also exactly what makes them interesting targets. A Mythos-class model in the wrong hands would look at a developer's machine and see an open door.

This isn't hypothetical for us. EDAMAME documented the March 2026 Trivy/LiteLLM supply chain attack in detail: a compromise at the dependency layer, invisible to static scanners, propagating silently through developer toolchains across hundreds of affected environments. With AI-accelerated vulnerability discovery, the next attack of that kind won't be a one-off. There will be many, running simultaneously.

Static scanning can't keep up — and that's not a criticism, it's a structural fact

The standard advice after a major vulnerability disclosure is: update your scanning tools and patch immediately. That advice was sound when zero-days emerged slowly enough that scanning databases could keep pace. It doesn't hold in a world where thousands of novel, previously unknown vulnerabilities are being discovered and validated in weeks.

Static and signature-based tools work by recognizing what they've seen before. They're fast, they're reliable for known threats, and you should absolutely keep using them. But by definition, they cannot detect a zero-day — a vulnerability with no prior signature, no CVE, no database entry. And in the post-Glasswing landscape, that's increasingly the category that matters most.

Patch cycles address yesterday's known vulnerabilities. Behavioral detection addresses whatever is running right now.

Runtime behavioral detection inverts the dependency. Instead of asking "does this match a known threat?", it asks "is this process doing something it shouldn't?" A zero-day using a novel exploit path still produces behavioral signals — unexpected network calls, file access outside normal scope, child processes that have no reason to exist. The detection doesn't require knowing the vulnerability. It requires knowing what normal looks like.

What this means in practice

I want to be direct about what we're saying and what we're not. We're not saying stop patching. We're not saying static scanning is useless. Both of those things matter and should be part of every team's security practice.

What we are saying is that those two layers alone are no longer sufficient. The threat model has changed. Adversaries with access to Mythos-level AI can scan your open-source dependencies for the same class of vulnerabilities Anthropic found, without Anthropic's responsible disclosure process, on their own timeline.

The development environment is where this threat lands first, because it's the most permissive and the least monitored node in most organizations' security architecture. Broad permissions. Low observability. Direct access to source code and credentials. That's the environment EDAMAME was built to protect — and this week's news is the clearest articulation of why that matters that I've seen since we started building it.

A last thought

The Mythos announcement is being framed, in a lot of places, as either purely good news (defenders now have powerful tools) or purely alarming news (attackers will too). I think both framings miss the important thing, which is that the rules have changed structurally. The volume and speed of vulnerability discovery has crossed a threshold. Defense can't be reactive at that volume.

The teams that come out of this era well won't necessarily be the ones with the biggest security budgets. They'll be the ones who built their security posture around the assumption that unknown vulnerabilities exist in their stack right now and set up detection accordingly.

That's what we're building at EDAMAME. I'm glad the conversation is finally catching up.