Claude Mythos Is Finding Microsoft Vulnerabilities Faster Than They Can Be Patched

In mid-May, dozens of Microsoft engineers and managers gathered in a conference room at the company's Redmond headquarters, joining remotely to confront a growing crisis.

The tech giant was racing to fix weaknesses in its code that Anthropic's new AI model, Claude Mythos Preview, was uncovering at an unprecedented clip.

According to a recording of the meeting viewed by ProPublica, one manager confirmed that Mythos was surfacing bugs faster than Microsoft could patch them, leaving engineers in what he described as "a mad dash" to close the gap.

One slide from the presentation showed that in April alone, Mythos had uncovered 90 "critical" bugs and 141 "important" ones in SharePoint, Microsoft's widely used collaboration software. In the first half of May, the model found even more.

"Please, please, please if your org has any April bugs, drive those down." – Hans Andersen, Microsoft engineering manager, urging his team to clear vulnerabilities before adversaries caught up

Engineering manager Hans Andersen implored the group to prioritize the April bugs, warning that they had roughly two weeks before May 31 — the date he described as when "the rest of the world will have caught up".

One engineer on the call summed up the predicament: "So basically you're saying if it's released on June 1, then on June 2 the adversaries will have our bugs?" The response from colleagues was a chilling "Yep".

The internal documents suggest that the window for defenders to fix flaws before adversaries could exploit them had already closed for part of Microsoft's product line, weeks before the Five Eyes intelligence alliance issued a public warning in late June.

The situation underscores a fundamental imbalance in the economics of cybersecurity. Finding a vulnerability once required a scarce combination of expertise, patience, and time. Today, AI can automate discovery at scale.

 Anthropic says its Project Glasswing partners, including Microsoft, used the model to identify more than 10,000 estimated high- or critical-severity vulnerabilities in a single month.

 However, the process of validating, testing, distributing, and deploying fixes still requires significant human effort. This "remediation divide" — the gap between automated discovery and manual patching — is widening.

The challenge extends beyond sheer volume. Mythos can chain several lower-severity flaws together into a single attack path capable of doing far more damage than any one flaw alone.

 While Microsoft is prioritizing critical and important bugs, roughly 300 moderate-severity flaws have been set aside for later attention, and low-severity bugs went unmentioned entirely.

The company's approach reflects a traditional triage system that may no longer be adequate for an AI-driven threat landscape. As ProPublica notes, the day of cyber reckoning may already be here.

As AI-driven vulnerability discovery becomes the new normal, the industry must shift its focus from how many bugs an AI can find to how many can be safely removed. The era of AI-powered offensive security is here — and the defenders are still catching up.