Anthropic's Mythos AI Finds New Bugs Fast. Your Old Unpatched Ones Are Still the Real Danger.

Key points

• Anthropic launched Mythos, an AI system that automatically hunts for software security flaws, on 7 April 2025.
• Mythos files discovered flaws as CVEs (Common Vulnerabilities and Exposures), the unique ID numbers that catalogues every known software bug so vendors and defenders can talk about the same problem.
• Exploit code, software that turns a known flaw into a working attack, now appears within 3 to 7 days of a bug being made public.
• Most organisations take 45 days or more to apply a critical patch, leaving a roughly six-week window where attackers can walk straight in.
• Measuring the gap between when a vendor releases a patch and when it lands on every affected system is the single most important metric most companies are not tracking.

Anthropic, the company behind the Claude family of AI assistants, unveiled a tool called Mythos on 7 April 2025. As first reported by ThreatVectr, Mythos reads software code the way a human security researcher would, only far faster, and it automatically files what it finds as CVEs. The security industry promptly started worrying about the flood of new entries that would pour into an already overloaded catalogue.

That worry is real. It is also the wrong thing to focus on.

Look at breach report after breach report from the last five years and the same pattern appears. Attackers did not find a clever zero-day, meaning a flaw nobody knew about yet. They walked in through a flaw the vendor had already patched, sometimes months or even years before the attack, that the victim simply had not gotten around to fixing.

Does Mythos actually make companies less safe?

Not directly. But it does make a pre-existing problem harder to ignore. Here is the arithmetic. If your organisation takes 45 days on average to apply a critical patch, and working exploit code for a new bug appears within 3 to 7 days of disclosure, you are exposed for close to six weeks on every serious flaw. Mythos speeds up the discovery side of that equation. It does nothing about the delay on the other side.

For ordinary people, this matters in a practical way. The companies that hold your medical records, your bank details, your shopping history: their security depends not just on finding bugs but on fixing the ones they already know about. A smarter discovery tool is only useful if the patching process behind it can keep up.

So what should defenders actually change? Four things stand out.

First, measure the patching window. Not the total count of open CVEs sitting in a queue. The number of days between a vendor releasing a fix and that fix reaching every affected system, sorted by how serious the flaw is. If that number does not exist today, producing it is the first project.

Second, shrink it. A 30-day deadline for critical patches is no longer aggressive; it is the minimum. For flaws with working exploit code already in the wild, seven days is a more defensible target.

Third, build an accurate asset inventory, a complete list of every computer, server and service the organisation actually runs. Every incident responder has the same story: the forgotten server in a back room, the acquired company's systems nobody mapped. Mythos-scale discovery will find those machines before any patching team does.

Fourth, read vendor security advisories on the day they publish and act on them. If a critical fix requires a committee meeting before it ships, the committee process is itself a vulnerability.

Mythos did not break anyone's security programme. It made the clock run faster. Whether that matters depends entirely on how long the window has been open already.