Claude Mythos found a 27-year-old bug. What that means for your attack surface

The facts first, because the headlines were louder than the substance. Anthropic did not release Mythos to the public. It runs a controlled programme, Project Glasswing, with 40+ partners such as Microsoft, Apple, AWS, Cisco, Nvidia and the Linux Foundation. Mozilla used it to find and fix 271 vulnerabilities in Firefox. A preview came out on 9 June, was pulled three days later because of US export rules, and partially returned to some US organisations at the end of June. Access costs several times more than a regular frontier model.

What it does is the interesting part. Mythos does not just spot a suspicious line of code. It chains flaws together: in the Linux kernel it combined two to four separate bugs, using one to defeat address randomisation and another to read memory before it wrote anything. In a browser it built a four-step chain that escaped both the renderer and the operating system sandbox. For FreeBSD it constructed a 20-gadget exploit spread over six network packets and came out with root. That is the work of a skilled human exploit developer, done by a model in hours.

The bugs it found were not new. The OpenBSD flaw had been there since 1999, the FFmpeg one since 2003. They survived decades of human review because nobody had the time to read that much code that carefully. A model does.

Anthropic is clear about the balance. In the long run, they expect models like this to help defenders more than attackers, because the same capability finds the bugs before they are abused. In the short run, they write, it could favour attackers if frontier labs are careless about release. Two things make that short run uncomfortable.

First, the gap between the restricted models and the open ones is measured in months, not years. Research from the Alan Turing Institute puts the average capability gap at around three months, and uncensored variants of open models tend to appear within days of a release. Whatever Mythos can do today, something close to it will be widely available before long.

Second, the bottleneck was never finding vulnerabilities. It was fixing them. In large organisations more than 45% of known vulnerabilities are still open a year after discovery. When the rate of discovery goes up by an order of magnitude and the rate of patching does not move, the backlog of exploitable, known issues grows. That backlog is what attackers actually use. Most breaches we see in practice do not start with a zero-day. They start with an exposed system, a known bug that was never patched, a leaked credential or a misconfiguration that nobody noticed.

So the reading is this: Mythos raises the ceiling of what is findable. For most companies, the floor is the problem. The floor is what is already visible from the outside, right now.

You do not need Mythos to be tested the way an attacker would. You need three things that have not changed: know what you expose, fix it in a reasonable time, and check that the fix holds.

Know what you expose

Every finding Mythos produced was reachable from the outside or through a normal user path. Your version of that question is simpler: which domains, subdomains, services, cloud environments and credentials of yours are visible and reachable from the internet today? Most organisations cannot answer that from memory. The AI Exposure Scan answers it from just your domain, in minutes, and keeps answering it as things change.

Test like an attacker, not like a checklist

Automated scanners list what could be a problem. An attacker, human or model, chains what is actually a problem. That is why our AI Pentest pairs AI agents of the AI Deep Scan that test broader and faster than can be done manually with ethical hackers who validate and prove every finding. The model finds the path, the specialist decides whether it matters, and you get evidence instead of a list of maybes. Our agents are not Mythos, and we do not pretend they are. They do not need to be to find what most companies have left open. If you are weighing a scan against a pentest, we wrote up the difference.

Shorten the loop from finding to fixed

The one recommendation Anthropic makes to every defender is to shorten patch cycles. In practice that means findings land with the developers who can fix them, with the evidence they need, and a retest confirms the fix. That is what the PenPortal is for. And for teams that ship every week, Continuous Pentesting puts a specialist next to the team so testing happens while you build, not once a year.

A practical list for the coming quarter, in the order that pays off fastest.

Map your external attack surface and remove what does not need to be there. Forgotten test environments, old subdomains and unused services are where decades-old bugs live.

Set a patch target for everything internet-facing and measure it. Thirty days for critical issues is a reasonable starting point; most organisations are nowhere near that today.

Treat legacy as exposed until proven otherwise. If a component is no longer maintained by its vendor, assume a model will eventually find what the vendor did not. Isolate it, put it behind something you do control, or plan its replacement.

Have your systems tested by people who think like attackers, with an AI Pentest or, for mature programmes, Red Teaming, and fix and retest what they find. A report nobody acts on protects nothing.

Use the reporting. NIS2 and ISO 27001 expect you to test regularly and to show the results. A pentest report, a management summary and retest evidence are exactly that.

Mythos is a milestone, and it will be followed by others. The companies that come through it well are not the ones with access to the most powerful model. They are the ones that know what they expose, fix it quickly and prove it. When you know, you know.