Anthropic's Claude Mythos Preview, an AI model designed for vulnerability detection, identified over 23,000 potential security flaws across 281 open-source projects. However, only a small fraction of these candidates have undergone human review, with the vast majority remaining unchecked due to a reported shortage of personnel.
Of the 23,019 candidate vulnerabilities, 1,900 were sent to external security firms for review. As of May 22, 2026, 1,596 reports were submitted to project maintainers, who acknowledged 1,451 of them. This process led to 97 fixes being integrated upstream and 88 published security advisories. The remaining 21,119 candidates have not been reviewed by anyone outside Anthropic.
The software supply chain company Echo, which compiled these figures, noted that the 1,900 candidates selected for review were likely not a random sample. Among these reviewed candidates, 1,726, or 90.8%, were confirmed as genuine vulnerabilities. This high confirmation rate may reflect the quality of the best candidates rather than the overall accuracy of the model across all its findings.
A significant discrepancy was observed in severity ratings. Out of 27 advisories that received CVEs, Mythos initially rated eight as Critical, 15 as High, and four as Medium. Independent CVSS scoring and assessments by affected maintainers resulted in a different distribution: one Critical, 16 High, eight Medium, and two Low. Only one of Mythos's Critical ratings was upheld.
Two specific examples highlight the model's limitations in assessing severity. For Temporal Server, Mythos assigned a Critical rating, describing an attacker's ability to control workflows across namespaces. However, Temporal's maintainers rated it 2.3 (Low), explaining that exploitation requires an attacker-controlled namespace with existing privileged internal credentials, and the impact is limited to known workflows. Similarly, Mythos rated a MinIO flaw as Critical, an external firm rated it High, and MinIO ultimately settled on Medium, noting that the attack requires an existing cluster root JWT and only allows read access. These examples suggest that the model struggles to account for deployment assumptions, privilege boundaries, and attack preconditions, which are difficult to infer solely from source code. Across the 27 CVEs, 14 had severity mismatches, with 13 being overstated by Mythos and one, a flaw in the `jq` command-line JSON tool, being understated.
Beyond detection, Mythos demonstrated a notable capability in exploit generation. In a benchmark involving 50 previously discovered vulnerabilities in the SpiderMonkey JavaScript engine (Firefox 147), Claude Mythos Preview converted a known crash into a working arbitrary code execution exploit in 181 out of 250 trials (72.4%), achieving partial register control in an additional 29 trials. This represents a significant improvement over Claude Opus 4.6, which succeeded in only two trials, a rate below 1%. This roughly 90-fold jump in success rate comes with caveats: each trial started from an already identified crash, the testing environment removed Firefox's browser sandbox and other defense-in-depth protections, and the evaluation was designed and conducted by Anthropic without independent replication.
Anthropic also reported using Mythos to turn a known Linux kernel use-after-free vulnerability into a working root exploit for less than $2,000 in inference costs and under a day of runtime, by chaining it with a second use-after-free flaw found in the kernel's traffic-control scheduler. While finding actionable vulnerabilities still costs thousands of dollars, there is no guarantee of a high- or critical-severity outcome.
A July 2026 survey by Echo of over 80 senior US security leaders indicated that 37% identified detecting more vulnerabilities than they can remediate as the biggest barrier to improving software supply chain security. Additionally, 11% stated that more detection or scanning would be their next investment. Anthropic has confirmed additional vulnerabilities internally that have not been sent to maintainers, citing a lack of review capacity within its own team and among its external partners.
