{"slug": "anthropics-mythos-finds-windows-bugs-faster-than-microsoft-can-patch-them", "title": "Anthropic’s Mythos finds Windows bugs faster than Microsoft can patch them", "summary": "Anthropic's Mythos AI model has identified software vulnerabilities in Microsoft's SharePoint faster than Microsoft can patch them, uncovering 90 critical and 141 important bugs in April alone, according to a ProPublica report. Microsoft's July Patch Tuesday fixed a record 622 bugs, and the company's engineering manager Hans Andersen described a 'mad dash' to close the gap before May 31, when adversaries were expected to catch up. The model has also found over 10,000 high- and critical-severity vulnerabilities across 50 organizations in Project Glasswing, including 2,000 bugs at Cloudflare, and broke into classified U.S. government systems in hours during a red-team exercise.", "body_md": "ProPublica revealed that Anthropic’s Mythos AI model has been identifying software vulnerabilities faster than Microsoft can patch them. In a mid-May meeting, engineering manager Hans Andersen told staff they were in *“a mad dash”* to close the gap, with roughly two weeks *“to find as many things and do as much good as we can with this access.”* May 31, he explained, *“is considered the day when the rest of the world will have caught up.”*\n\n**The scale of the problem**\n\nThe numbers are staggering. In April alone, Mythos uncovered 90 *“critical”* bugs and 141 *“important”* ones in SharePoint, Microsoft’s widely used collaboration software. In the first half of May, it found even more.\n\nMicrosoft’s July Patch Tuesday release fixed 622 bugs, an all-time high, blowing past the previous record of over 200 set just in June. Only seven were categorized as low- or moderate-severity, according to Dustin Childs of the Zero Day Initiative.\n\n*“The bug apocalypse has fully descended upon us,”* Childs wrote. One internal presentation predicted that the group working on SharePoint *“will be busy for months,”* first working through critical bugs, then tackling important ones in August, before beginning work on roughly 300 *“moderate”* bugs.\n\n**Chaining flaws and the AI arms race**\n\nTo this point, the most concerning development is that Mythos can chain together multiple low-severity bugs to [create a devastating attack](https://thecoinheadlines.com/tech-and-ai/imf-warns-of-systemic-financial-risks-amid-ai-explosion-cites-mythos-as-case-study/article-17428/). Vinh Nguyen, former chief AI officer at the National Security Agency (NSA) and now a senior technical adviser to Anthropic, warned:\n\n*“The problem now is that you can chain four low-level flaws, and that can equal a high severity. If you’re Microsoft, the current triage strategy may be underpricing risks.”*\n\nThe May 31 deadline was significant because the Five Eyes intelligence alliance had warned that the window of opportunity to fix flaws before adversaries gain similar capabilities was closing. Microsoft tried to act like it wasn’t a big deal (downplaying the date’s significance), but the engineers knew better: *“If it’s released on June 1, then on June 2 the adversaries will have our bugs.”*\n\n**Beyond Microsoft: Mythos’s relentless bug hunt**\n\nMicrosoft is not alone in facing [Mythos’s bug-hunting capabilities](https://thecoinheadlines.com/tech-and-ai/anthropic-reveals-claude-hacked-3-real-companies-during-security-evaluations/article-27955/). In less than two months, Anthropic reported that Mythos Preview uncovered over 10,000 high- and critical-severity vulnerabilities across roughly 50 organizations participating in Project Glasswing. Cloudflare alone found 2,000 bugs, with 400 classified as high- or critical-severity, a false positive rate better than human testers.\n\nThe model’s [reach](https://thecoinheadlines.com/tech-and-ai/ai-model-cuts-post-quantum-algorithm-hawks-security-in-half-in-just-60-hours/article-27628/) has extended into [classified government systems](https://thecoinheadlines.com/tech-and-ai/anthropics-mythos-ai-model-found-vulnerabilities-in-classified-u-s-systems-in-hours/article-23422/) as well. When U.S. intelligence agencies put it through its paces during a testing exercise back in June 2026, Mythos managed to spot security vulnerabilities in these highly sensitive government computer networks in just a matter of hours.\n\nSenator Mark Warner disclosed that the tool *“broke into almost all of our classified systems, not in weeks but in hours.”* The NSA and Cyber Command confirmed the testing, though it was a controlled red-team exercise rather than an outside breach.\n\nNevertheless, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is reportedly using Anthropic’s [AI model Mythos to audit government software code](https://thecoinheadlines.com/tech-and-ai/cisa-uses-anthropics-mythos-to-audit-government-code-despite-tensions/article-25114/), too.\n\nWhat’s clear is that the bottleneck is no longer discovery. As Anthropic itself noted, progress on software vulnerability is now limited by the speed of verification, disclosure, and patching, not the ability to find bugs. The era of finding more vulnerabilities than can be fixed has arrived.", "url": "https://wpnews.pro/news/anthropics-mythos-finds-windows-bugs-faster-than-microsoft-can-patch-them", "canonical_source": "https://thecoinheadlines.com/tech-and-ai/anthropics-mythos-finds-windows-bugs-faster-than-microsoft-can-patch-them/article-28983/", "published_at": "2026-08-11 17:49:16+00:00", "updated_at": "2026-08-11 18:16:28.939572+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-policy", "ai-research", "ai-products"], "entities": ["Anthropic", "Mythos", "Microsoft", "SharePoint", "ProPublica", "Hans Andersen", "Cloudflare", "CISA"], "alternates": {"html": "https://wpnews.pro/news/anthropics-mythos-finds-windows-bugs-faster-than-microsoft-can-patch-them", "markdown": "https://wpnews.pro/news/anthropics-mythos-finds-windows-bugs-faster-than-microsoft-can-patch-them.md", "text": "https://wpnews.pro/news/anthropics-mythos-finds-windows-bugs-faster-than-microsoft-can-patch-them.txt", "jsonld": "https://wpnews.pro/news/anthropics-mythos-finds-windows-bugs-faster-than-microsoft-can-patch-them.jsonld"}}