Finding them is one thing. Fixing them is another.
In a moment that quietly redraws the boundary between human oversight and machine capability, Anthropic's Claude Mythos AI has surfaced more than 10,000 critical vulnerabilities in the enterprise software that underpins modern life — not as a thought experiment, but as a lived reality. Project Glasswing has demonstrated that large language models can perform security auditing at a scale no human team could match, drawing major partners like Verizon into its orbit. Yet the discovery poses a question older than any algorithm: finding what is broken is not the same as having the will, the time, or the capacity to repair it.
- Ten thousand critical flaws in widely-used software is not an abstraction — these are live weaknesses that attackers could exploit today to steal data, disrupt services, or compromise critical systems.
- The sheer velocity of AI-driven discovery has outpaced the industry's existing remediation infrastructure, threatening to turn a breakthrough tool into a mirror reflecting how overstretched software security already is.
- Verizon's formal partnership with Anthropic signals that corporate confidence in AI security auditing has crossed from curiosity into commitment, and other enterprises are almost certainly preparing to follow.
- The industry now faces an urgent reckoning over disclosure norms — how long vendors should have to patch before vulnerabilities become public knowledge when AI can uncover flaws at unprecedented speed.
- Project Glasswing has moved automated vulnerability detection from a long-held dream to a demonstrated reality, but whether it produces safer software depends entirely on what mobilization happens next.
Anthropic's Claude Mythos AI, operating under the banner of Project Glasswing, has uncovered more than 10,000 high-severity vulnerabilities in enterprise software that millions of people depend on daily. The initiative was designed to test whether large language models could systematically find security flaws at scale — and the answer, it turns out, is a resounding yes.
The volume alone is sobering. These are not theoretical weaknesses caught in a lab; they are real gaps in real systems, the kind that could be exploited to steal data or disrupt operations. The discovery forces an uncomfortable question about how many of these flaws would have remained invisible under traditional auditing methods.
Verizon Communications has already moved from skepticism to action, partnering with Anthropic to deploy the technology across its operations. When a company of that scale commits to a new security methodology, the rest of the industry takes notice — and many are likely already exploring similar arrangements.
But the harder problem begins where the discovery ends. The software industry already carries significant remediation backlogs, with developers stretched thin and patch cycles measured in months. If Mythos can find vulnerabilities faster than teams can fix them, the tool becomes less a solution and more an unflattering portrait of how software gets built and maintained.
Disclosure timelines add another layer of urgency. The longstanding norms around responsible disclosure — how much time vendors receive before vulnerabilities become public — were built for a slower world. AI-assisted hunting accelerates the pace of discovery in ways those norms were never designed to absorb.
Project Glasswing has proven that AI can do meaningful security work at enterprise scale. Whether that translates into genuinely safer software now depends on whether companies can mobilize the resources to fix what has been found, and whether the industry can build responsible practices fast enough to keep pace with the machines doing the finding.
Anthropic's Claude Mythos AI has identified more than 10,000 high-severity vulnerabilities in enterprise software that millions of people rely on every day. The discovery emerged from Project Glasswing, an initiative designed to test whether large language models could systematically uncover security flaws at scale—and the results suggest they can.
The sheer volume is striking. Ten thousand critical bugs is not a theoretical concern or a laboratory curiosity. These are real weaknesses in real software, the kind that could be exploited by attackers to steal data, disrupt operations, or compromise systems. The fact that Mythos found them raises an uncomfortable question: how many of these flaws would have gone undetected using traditional security auditing methods?
Verizon Communications has already moved beyond skepticism into partnership. The telecommunications giant is working with Anthropic to deploy this technology, a signal that major corporations believe the approach works and matters. When a company the size of Verizon commits resources to a new security methodology, it carries weight. Other enterprises are watching, and some are likely already exploring similar arrangements.
What makes this moment significant is not just the number of bugs found, but what it reveals about the gap between how software is currently secured and how it could be. Automated vulnerability detection at this scale has long been the dream of the security industry—the ability to scan millions of lines of code and flag problems before they reach production. Mythos appears to have moved that dream closer to reality.
But the discovery also surfaces a harder problem: what happens next? Finding 10,000 vulnerabilities is only useful if those flaws can actually be fixed. The software industry already struggles with remediation backlogs. Developers are stretched thin. Patch cycles take time. The question now is whether companies have the capacity to address vulnerabilities at the pace that AI can uncover them. If Mythos can find flaws faster than teams can fix them, the tool becomes less a solution and more a mirror held up to an uncomfortable truth about how software gets built and maintained.
The disclosure timeline matters too. How quickly should these vulnerabilities be made public? How much time should vendors have to patch before details become widely known? These are not new questions in security, but they become more urgent when the volume of discoveries accelerates. The industry will need to develop new norms around responsible disclosure in an age of AI-assisted vulnerability hunting.
For now, Project Glasswing stands as proof that artificial intelligence can perform meaningful security work at enterprise scale. Whether that capability translates into actually safer software depends on what happens in the months ahead—on whether companies can mobilize the resources to fix what has been found, and whether the industry can establish responsible practices around disclosure and remediation. The flaws are real. The question is whether the will to address them matches the speed at which they can be discovered.
A Conversa do Hearth Outra perspectiva sobre a história
So Mythos found ten thousand bugs. That's a number. But what does it actually mean for someone running a business?
It means there are ten thousand ways their systems could fail or be compromised that they didn't know about yesterday. Some of those flaws might never be exploited. Others could be catastrophic.
Why didn't they find these bugs themselves?
Because finding them requires either a lot of human time or a tool that can read code the way Mythos does. Most companies don't have enough security people to audit everything. Mythos can do it in hours.
And Verizon is betting on this. Why?
Because if it works, it changes the economics of security. Instead of hiring more auditors, you run Mythos. You get a report. You fix things. It's faster and cheaper.
But can they actually fix ten thousand bugs?
That's the real question. Finding them is one thing. Fixing them is another. If Mythos finds flaws faster than teams can patch them, you've just created a new kind of problem.
What happens if these vulnerabilities leak before they're fixed?
That's why disclosure matters now. The industry has to figure out how much time vendors get to patch before the world knows about the flaws. Move too fast and nothing gets fixed. Move too slow and attackers might find them anyway.