# Progressive disclosure for mathematical proofs: The parallel with cybersecurity > Source: > Published: 2026-09-12 22:02:27+00:00 # Progressive disclosure for mathematical proofs The parallel with cybersecurity after the Mythos moment The [companion article](../math/Navier-Stokes.html) covers the Navier–Stokes “incident” itself. Here I want to look at a parallel: AI agents are finding security bugs and producing mathematical proofs faster than the people working in these fields can absorb them. Can mathematics borrow from coordinated vulnerability disclosure? I’d propose a registry that records work as it develops, with timestamps that others can verify, together with circles that gradually widen before public release. This would give people a record of their contribution without having to rush an unfinished proof out. But it only helps if we also give credit to ideas and partial results. # What AI did to two communities Since the Mythos moment, there has been a huge capability jump in AI agents discovering cybersecurity bugs autonomously. On 7 April 2026, Anthropic announced Claude Mythos Preview and reported finding zero-day vulnerabilities in every major operating system and web browser, largely without human steering ([Anthropic 2026c](#ref-anthropicProjectGlasswing2026)). By 26 August, its disclosure programme had reported 2,300 vulnerabilities to maintainers across 392 open source projects, with 421 known to have been patched upstream ([Anthropic 2026a](#ref-anthropicCoordinatedVulnerabilityDisclosure2026)). Finding the bugs is only part of the work. Someone still has to review the reports, fix the problems, and get those fixes to users. Similarly, that capability landed in mathematics. In July, Levent Alpöge announced a counterexample disproving the Jacobian conjecture in dimension three, and by stabilization in every dimension above two. His post credited Akhil Mathew for asking the question, and Claude Fable 5 for the work that found it ([“A Counterexample to the Jacobian Conjecture” 2026](#ref-ulamCounterexampleJacobianConjecture2026)). Fable 5 is the public release of the model Anthropic had called Mythos ([Constantin 2026](#ref-constantinAIJustBroke2026)), so this is the same moment arriving in mathematics, not a later one. In August, Anthropic reported improving the lower bound on the proportion of nontrivial zeta zeros on the critical line from 41.6% to 67.2% ([Anthropic 2026b](#ref-anthropicLearningMoreClaude2026)). In September, OpenAI claimed a proof of the forced breakdown alternatives C/D of the Navier–Stokes Millennium Prize Problem ([OpenAI 2026b](#ref-NavierStokesMillennium2026), [2026a](#ref-openaiFiniteTimeBlowup2026)). Two other groups announced work on Euler blowup that week, though these were different results at different stages of verification, as the [companion article](../math/Navier-Stokes.html) explains. ## Parallels Autonomous AI agents are super-human in persistence, parallelizability, and the ability to chain together deep knowledge across domains. In the case of bug hunting, it is manifested in chaining together multiple vulnerabilities into a deployable exploit, sometimes at zero-day level. Anthropic reports that Mythos Preview developed a browser exploit using four vulnerabilities to escape both the renderer and operating system sandboxes ([Carlini et al. 2026](#ref-anthropicAssessingClaudeMythos2026)). In the case of math theorem (dis)proving, it is manifested in applying ideas from one field to another, working through many variations of a construction in parallel, and persisting with calculations a human might have to abandon. OpenAI reports roughly 10,000 concurrent agents in the group that found its Navier–Stokes proof, with a result 88 hours after launch ([OpenAI 2026b](#ref-NavierStokesMillennium2026)). And the output can be difficult to digest, even when it is useful. In the case of bug reports, the difficulty is mostly the sheer number of them. However, several maintainers report that the quality has improved substantially in 2026. rclone’s Nick Craig-Wood says about 75% of the disclosures they received had something worth investigating, as quoted by Simon Willison ([Willison 2026a](#ref-willisonJustRumourBug2026)).[1](#fn1) SQLite’s policy, reported by Willison in May, accepts agentic bug reports with a reproducible test case, while refusing agentic code for incorporation into the project ([Willison 2026b](#ref-willisonSqliteAgents2026)). A test case gives the maintainer something concrete to investigate without having to trust the report’s prose. In the case of math however, it is much worse. Even a verified Lean proof doesn’t remove the work needed to understand why the proof works.[2](#fn2) The Jacobian counterexample makes the distinction particularly clear: its explicit polynomial map is easy to check, yet Tao still wrote an entire post explaining the construction geometrically ([Tao 2026a](#ref-taoDigestionJacobianConjecture2026)). Buckmaster describes his own Lean-verified Euler write-up as “AI slop” ([Buckmaster 2026](#ref-buckmasterStatement2026)). Checking a result and understanding it are different tasks. In these examples, understanding takes far more work. It also doesn’t take much information to start another search. In the case of finding exploits, Anil Madhavapeddy opened a public PR fixing a path traversal bug in OCaml’s `cohttp`, and within about ten minutes his website was receiving probes for that pattern. Given the affected code and a suggestion to investigate path normalisation, his own agent produced an exploit in under a minute ([Madhavapeddy 2026](#ref-madhavapeddyJustRumourBug2026)). In the case of math, OpenAI says it launched its search on 1 September after hearing a rumour that two Millennium Prize problems had been resolved. It later connected the rumour to Alpöge and Buckmaster’s personal collaboration on forced Euler ([OpenAI 2026b](#ref-NavierStokesMillennium2026); [Buckmaster 2026](#ref-buckmasterStatement2026)). The rumour was confused, but apparently enough to encourage OpenAI to spend the compute. Finally, the rush disrupts the lives of people working on these projects. The pace of Silicon Valley, with all its toxicity, gets shoved into other people’s lives. In the case of open source maintainers, many work as volunteers or alongside other jobs. Even those paid to maintain software can struggle with the volume. Daniel Stenberg reports that curl’s incoming security reports were arriving four to five times faster than in 2024, averaging more than one per day. He describes his wife worrying about his work hours and his own concern for his teammates ([Stenberg 2026](#ref-stenbergPressure2026)). For curl, the pressure wasn’t a sudden wave of severe bugs: as of that May post, its most recent HIGH severity CVE was from October 2023. The volume of work was enough. In the case of mathematicians, how many of them have worked on a problem for years and found themselves needing to rush the proof out of the door at the last minute, just so that OpenAI isn’t claiming all the credit? Buckmaster and Anandkumar were both in exactly this position within the same week, as we shall see in [the rush is the harm](#the-rush-is-the-harm). ## Differences The incentive to release first is not the same. In cybersecurity, the software is already deployed and the bugs are already there. A discovered vulnerability may be independently found or already exploited by someone else. The urgency depends on exposure and exploitability as well as severity. Coordinating disclosure gives maintainers time to prepare a fix, although it cannot guarantee that attackers will wait. In mathematics, much of the pressure comes from how the community assigns credit. Being first to prove a famous conjecture attracts disproportionate recognition, even though earlier ideas and later explanations also matter. Mathematicians often present work in a close circle and gradually refine it before releasing a preprint. Peer review can then take years for a major proof. An AI lab’s announcement schedule can compress that process into days. There’s another difference. In security, AI can help with the response as well as the discovery. Mozilla reports shipping fixes for 423 security bugs in April, including bugs found with Mythos Preview, other models, and conventional methods ([Grinstead et al. 2026](#ref-mozillaBehindScenesHardening2026)). AI can help explain and formalize mathematics too. But for the pure mathematics discussed here, there usually isn’t an equivalent public-safety deadline for releasing a proof. We have more room to take time over understanding it, if the competition for credit allows us to. ## The rush is the harm Does that difference break the analogy? In security, delaying disclosure can protect users. In mathematics, it might appear to protect only a priority claim. But the rush affects other people too. Buckmaster says outside pressure led him and Alpöge to release papers whose presentation they were unhappy with; they had wanted weeks to make the proofs readable ([Buckmaster 2026](#ref-buckmasterStatement2026)). Anandkumar describes the last few days as “a flurry of activity”: her group scrambled to release after hearing about the NYU release and OpenAI’s expected announcement, going live on the evening of 7 September, the day before that announcement. Her account still describes work needed to complete the stability proof ([Anandkumar 2026](#ref-septemberStableSingularityEuler2026)). Neither group released on its own timetable. One lab’s announcement schedule set the clock for everyone else. I’m not saying that making a theorem known is itself harmful. I’m asking whether we can avoid making people choose between a careful write-up and recognition for their work. The other mathematicians bear that cost, and so do the readers trying to learn from the resulting papers. On 11 September, 25 Fields Medallists signed a declaration warning that rushed announcements leave too little time for exposition, identifying new ideas, and crediting earlier work. They argue that solving problems should serve mathematical understanding, and that producing ever more true/false statements can undermine that aim ([Avila et al. 2026](#ref-fieldsMedallistsSevereMisalignment2026)). # The proposal: attestation, then widening circles In cybersecurity, coordinated disclosure gives the people responsible for vulnerable software a chance to respond before the details become public. That window is narrowing, though. Those probes arrived about ten minutes after Madhavapeddy’s fix became public, and rclone’s CVE assignments are running weeks behind the fixes they describe ([Madhavapeddy 2026](#ref-madhavapeddyJustRumourBug2026); [Willison 2026a](#ref-willisonJustRumourBug2026)). I don’t have an answer to that one. But the embargo isn’t the part worth borrowing. What mathematics needs from coordinated disclosure is the record: who had what, and when. Unlike an embargo, a record doesn’t stop working once somebody else hears about the result. And a credible record stops all the credit attaching to the last step, releasing a proof. I’d like us to treat a digestible explanation as part of the responsibility of releasing a major result. A Lean proof alone shouldn’t let the authors skip that work. Tao suggests a practical test: the authors should be able to give a clear talk to experts, explaining the result correctly and attributing the ideas properly ([Tao 2026b](#ref-taoMathematicsAgeAI2026)). But what should happen while that explanation is being developed? I’d propose a registry where someone can privately deposit work as it develops, with a timestamp others can verify. It could start as a private repo of one member, then gradually admit more people.[3](#fn3) What gets registered could be a draft proof, a partial calculation, or even a scan of a handwritten page. There needn’t be a completed theorem or a Lean proof.4 The attestation would give a trustworthy record of what someone had at a particular time. Someone who takes another month to write clearly would still have traces of their earlier work. The community can use those traces to work out who contributed what, including long after the result is published. There is a precedent in science: the *pli cacheté*, a sealed deposit that can later be opened to support a priority claim. Erren proposed reviving this approach for journals to reduce premature publication ([Erren 2009](#ref-errenEstablishingPriorityIdeas2009)). Anthropic’s disclosure dashboard uses a modern version: it publishes a hash commitment after external validation, reveals more metadata after notifying the maintainer, and withholds the bug’s details until the disclosure window closes ([Anthropic 2026a](#ref-anthropicCoordinatedVulnerabilityDisclosure2026)). Git gives us a way to keep the work and its history. We would need to build a trustworthy timestamping layer on top, so others can rely on that history later without the work having to be public now.5 And then we can gradually enlarge the circle. Invite mathematicians known to be working on the problem to review the proof. They may say, “actually we are working on this already, and here’s a record of our earlier results”, or point out what still needs work before release. An AI lab could provide model access to help these readers work through the proof. Interested grad students and postdocs could join too, with recognition for the work of understanding and explaining it. The circle should widen towards a public release once the argument is solid and the authors can explain it. This should also give people outside the initial network a chance to identify contributions that were missed. ## What if this starts another race? Telling a small circle about a result can alert a competitor, just as the rumour encouraged OpenAI to start its search. But how much can we rely on secrecy? Buckmaster’s prompts were private, yet OpenAI still had to investigate whether they could have influenced its model. It published its conclusion on 10 September, two days after the announcement, as discussed in the [companion article](../math/Navier-Stokes.html#sec-independence) ([OpenAI 2026b](#ref-NavierStokesMillennium2026)). Even establishing that separation took work, while the rumour had already started another search. Maintaining secrecy, and being able to assure others of it, is expensive and difficult. I wouldn’t want attribution to depend on everything staying secret until publication. That’s why attestation matters even when the initial circle is small. This goes together with recognizing ideas and partial results. If a lab builds on someone else’s unfinished work, the earlier contribution should count alongside the completion. If being second still counts for something, there is less pressure to rush an unfinished paper out just because somebody else moved first. Think of an amateur mathematician with a useful idea and no realistic way to finish it alone. They might hesitate to share it if they expect the eventual solver to receive all the recognition. A record of the idea, together with an expectation of partial credit, could make collaboration with someone able to finish it more attractive. That includes collaboration with an AI lab. Both sides could get something out of it. ## How do we credit unfinished work? Registering work doesn’t require us to settle its value at the time of deposit. That’s part of the point. A completed, correct proof is one contribution. An idea that makes the proof possible is another, and judging its value may require understanding how later work used it. We shouldn’t require every contribution to arrive as a completed proof before it can be recorded. Mathematicians already make these judgments when acknowledging earlier work. Historians also work out who contributed what, sometimes much later. And someone who thinks their contribution has been missed can come forward with their records and let the community assess it. The aim is to leave traces from the start, so this doesn’t all have to be reconstructed from memory and scattered emails. This refines the open development I argued for in the [companion article](../math/Navier-Stokes.html#sec-open-development). There I wanted the work visible immediately. Here I want it recorded immediately and shared progressively, giving people time to understand it while preserving evidence of the contributions along the way. ## Who would enforce this? I’m not proposing a central authority that decides who may publish a theorem. Mathematics should be free and open, at least eventually. Who stops a Martian from making a new proof, so to speak? I would like this to become a norm that mathematicians and AI labs agree to follow. It would need people to honour attribution and make time for review; building the registry alone won’t achieve that. The case for participating is that people could share work and collaborate with less pressure to rush it out. I use *responsible* for that duty of care, *coordinated* for agreeing with others on the release, and *progressive* for widening access as the work develops.6 ## Lean, mathlib, and who pays Formalization can happen alongside the mathematical work or later, including after a readable proof is public. The registry should work for mathematicians whether or not they use Lean. We shouldn’t stop there. There is tremendous value in properly modularizing the Lean proof and contributing its reusable parts to `mathlib`. AI labs could fund people to explain the mathematics and do this library work, so more of the value reaches the rest of the community. A more capable `mathlib` would also help the labs with their next endeavour. Win-win. Project Glasswing provides a funding precedent. Anthropic committed up to $100 million in model credits and donated $4 million to open source security organizations to help with the response ([Anthropic 2026c](#ref-anthropicProjectGlasswing2026)). This is a precedent for a lab supporting the work needed to turn its discoveries into something the community can use. I would like to see AI labs make a comparable commitment to mathematics. # References [https://www.ulam.ai/research/jacobian.pdf](https://www.ulam.ai/research/jacobian.pdf). *Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)*. RFC 3161. RFC Editor. [https://doi.org/10.17487/RFC3161](https://doi.org/10.17487/RFC3161). *Leiden Declaration on Artificial Intelligence and Mathematics*. Zenodo. [https://doi.org/10.5281/zenodo.20302944](https://doi.org/10.5281/zenodo.20302944). 3.” *What’s New*, September 10. [https://terrytao.wordpress.com/2026/09/10/stable-singularity-of-the-euler-equations-on-r3/](https://terrytao.wordpress.com/2026/09/10/stable-singularity-of-the-euler-equations-on-r3/). [https://red.anthropic.com/2026/cvd/](https://red.anthropic.com/2026/cvd/). [https://www.anthropic.com/research/riemann-zeta](https://www.anthropic.com/research/riemann-zeta). [https://www.anthropic.com/glasswing](https://www.anthropic.com/glasswing). *What’s New*, September 11. [https://terrytao.wordpress.com/2026/09/11/a-severe-misalignment-of-ai-in-mathematics/](https://terrytao.wordpress.com/2026/09/11/a-severe-misalignment-of-ai-in-mathematics/). [https://cims.nyu.edu/~tristanb/statement.pdf](https://cims.nyu.edu/~tristanb/statement.pdf). [https://www.anthropic.com/news/mythos-preview](https://www.anthropic.com/news/mythos-preview). [https://thenextweb.com/news/jacobian-conjecture-disproved-ai-fable-5](https://thenextweb.com/news/jacobian-conjecture-disproved-ai-fable-5). *Medical Hypotheses*72 (1): 8–10. [https://doi.org/10.1016/j.mehy.2008.08.013](https://doi.org/10.1016/j.mehy.2008.08.013). *Mozilla Hacks*, May 7. [https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/](https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/). *Front Matter*, August 22. [https://doi.org/10.59350/tngsm-6rx23](https://doi.org/10.59350/tngsm-6rx23). *Microsoft Security Response Center*, July 21. [https://www.microsoft.com/en-us/msrc/blog/2010/07/coordinated-vulnerability-disclosure-bringing-balance-to-the-force](https://www.microsoft.com/en-us/msrc/blog/2010/07/coordinated-vulnerability-disclosure-bringing-balance-to-the-force). [https://www.nngroup.com/articles/progressive-disclosure/](https://www.nngroup.com/articles/progressive-disclosure/). [https://cdn.openai.com/pdf/32d9f210-8b73-45e0-91bc-82a30aef8a9a/navier-stokes.pdf](https://cdn.openai.com/pdf/32d9f210-8b73-45e0-91bc-82a30aef8a9a/navier-stokes.pdf). *Crypto-Gram*, November 15. [https://www.schneier.com/crypto-gram/archives/2001/1115.html](https://www.schneier.com/crypto-gram/archives/2001/1115.html). *The Pressure*. May 26. [https://daniel.haxx.se/blog/2026/05/26/the-pressure/](https://daniel.haxx.se/blog/2026/05/26/the-pressure/). *What’s New*, July 21. [https://terrytao.wordpress.com/2026/07/21/a-digestion-of-the-jacobian-conjecture-counterexample/](https://terrytao.wordpress.com/2026/07/21/a-digestion-of-the-jacobian-conjecture-counterexample/). [https://doi.org/10.48550/arXiv.2608.16753](https://doi.org/10.48550/arXiv.2608.16753). *What’s New*, August 18. [https://terrytao.wordpress.com/2026/08/18/palomar-a-registry-of-lean-verified-mathematics/](https://terrytao.wordpress.com/2026/08/18/palomar-a-registry-of-lean-verified-mathematics/). *Simon Willison’s Weblog*, August 28. [https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug/](https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug/). *Simon Willison’s Weblog*, May 27. [https://simonwillison.net/2026/May/27/sqlite-agents/](https://simonwillison.net/2026/May/27/sqlite-agents/). ## Footnotes 1. Anthropic’s external reviewers confirmed 4,576 of 5,008 reviewed findings, a 91.4% true positive rate for that subset ( [Anthropic 2026a](#ref-anthropicCoordinatedVulnerabilityDisclosure2026) ). Craig-Wood also reports GitHub CVE assignment taking 3–4 weeks instead of 2–3 days, leaving rclone releases marked “CVE-PENDING” ([Willison 2026a](#ref-willisonJustRumourBug2026) ).[↩︎](#fnref1) 2. For what needs checking in a Lean proof, see the [companion article](../math/Navier-Stokes.html#sec-lean) .[↩︎](#fnref2) 3. The Leiden Declaration, published on 2 June 2026 and endorsed by the International Mathematical Union, and Tao’s ICM essay discuss publication norms, including disclosure of tool use, human accountability, attribution, and reviewing ( [Alper et al. 2026](#ref-leidenDeclaration2026) ;[Tao 2026b](#ref-taoMathematicsAgeAI2026) ). Neither proposes the centralized registry of work with attested timestamps and widening circles discussed here.[↩︎](#fnref3) 4. Palomar, incubated by the Lean FRO and ICARM, registers snapshots of repositories containing Lean proofs. Comparator checks the formal proof, and an LLM checks whether the informal description appears to match the formal statement. Tao explicitly distinguishes this from human peer review ( [Tao 2026c](#ref-taoPalomarRegistry2026) ). It serves a different purpose from the record of unfinished work proposed here, and the two could coexist.[↩︎](#fnref4) 5. Git’s dates can be set by its owner, so a private repo alone isn’t enough. Existing timestamp services could provide part of the infrastructure: RFC 3161 describes a service that signs a document hash together with a time ( [Adams et al. 2001](#ref-adamsTimeStampProtocol2001) ).[↩︎](#fnref5) 6. The terminology has a contentious history. In 2001, Schneier disputed Microsoft’s arguments for keeping vulnerability details secret ( [Schneier 2001](#ref-schneierFullDisclosureWindow2001) ). In 2010, Katie Moussouris explained Microsoft’s preference for “coordinated” over the subjective label “responsible” ([Moussouris 2010](#ref-moussourisCoordinatedVulnerabilityDisclosure2010) ). “Progressive disclosure” is also an interface design term for revealing additional complexity as needed ([Nielsen 2006](#ref-nielsenProgressiveDisclosure2006) ). Here I’m borrowing it for gradually widening access to research.[↩︎](#fnref6)