CVE Severity Spike After Claude Mythos Preview Release — Epoch AI Data
Epoch AI's analysis of publicly disclosed CVEs reveals a dramatic spike in high- and critical-severity vulnerabilities following Anthropic's April 2026 announcement of Claude Mythos Preview. In June 2026, 21 notable organizations — including Microsoft, Google, Apple, AWS, Oracle, Cisco, and others — disclosed approximately 1,500 high- and critical-severity CVEs. That's more than 3.5 times the previous monthly record set before Mythos Preview's release.
Key Findings
- 3.5x spike in high/critical CVEs in June 2026 over pre-Mythos monthly record.
- Anthropic's Project Glasswing — whose partners include Microsoft, Google, Apple, and AWS — has already discovered over 10,000 high- or critical-severity vulnerabilities, many not yet publicly disclosed.
- OpenAI runs a similar effort called Daybreak.
- Data is drawn from the public CVE repository, filtered to 21 reputable vendors to avoid noise.
Method & Caveats
Epoch filtered CVE.org data to only submissions from 21 named organizations (e.g., Microsoft, Google, Apple, Adobe, Oracle, etc.). This avoids capturing low-quality submissions from smaller vendors. The tracked metric is disclosed CVEs — not found but undisclosed ones. Anthropic claims Glasswing alone has identified over 10k, so the disclosed numbers may be a fraction of total discoveries. The increase could also partly reflect more research interest, not just model capability.
Impact for Developers
If you maintain or depend on software from major vendors, expect a wave of high-severity patches. The data suggests AI-assisted vulnerability discovery (both ethical and adversarial) is accelerating the zero-day discovery-to-patch cycle. Keep your dependency scanners updated and prioritize patching critical CVEs from these sources.
📖 Read the full source: HN AI Agents
👀 See Also
AI-Automated Daily Security Audit for AI-Operated Store
An AI-operated store runs a daily security audit autonomously without human scheduling or cron jobs. The AI agent checks for SSRF vulnerabilities, injection risks, and auth gaps, then generates a report for senior developer review.
NPM Compromise via Axios Backdoor: Impact on AI Coding Agents
On March 31, 2026, a DPRK-linked threat actor compromised npm by publishing backdoored versions of Axios (1.14.1 and 0.30.4) during a 3-hour window. The malware injected a dependency that downloaded a platform-specific RAT, harvested credentials, and self-erased, with AI coding agents like Claude Code and Cursor being particularly vulnerable due to automated npm installs.
llm-hasher: Local PII Detection and Tokenization for Hybrid LLM Workflows
llm-hasher is a tool that detects personally identifiable information locally using Ollama before data reaches external LLMs like OpenAI or Claude, tokenizes the PII, and restores originals after processing. It uses regex for structured data types and a local LLM for contextual detection, with encrypted storage for mappings.
Security Analysis of AI Agents Reveals Broken Trust Model and High Vulnerability Rates
A security analysis of AI agents shows the fundamental trust model is broken, with 49% of MCP packages having security findings and indirect injection achieving 36-98% attack success rates across state-of-the-art models.