Critical vulnerability disclosures surge following Claude Mythos Preview

The number of disclosed high-severity vulnerabilities (CVEs) spiked in 2026. In June, 21 major organizations published approximately 1,500 high and critical vulnerabilities, a figure more than 3.5 times higher than the previous monthly record set before the Mythos release.

The increase follows Anthropic’s April announcement that Claude Mythos Preview can autonomously identify software vulnerabilities. Partners in Project Glasswing, including Microsoft, Google, Apple, and AWS, utilized the model to find and patch bugs prior to public disclosure.

Since the inception of Project Glasswing, the initiative has identified over 10,000 high and critical vulnerabilities, many of which remain undisclosed individually. OpenAI conducts similar work through its Daybreak product. Epoch published the CVE data under a Creative Commons BY license.