Claude Mythos: When vulnerabilities arrive faster than patches

On 7 April 2026, Anthropic published something that fundamentally changes the security industry. Not a new vulnerability. Not a breach report. Proof that AI can carry out autonomous vulnerability research on a scale that human teams simply cannot match.

Claude Mythos, an internal AI model from Anthropic, independently discovered thousands of zero-day vulnerabilities in every major operating system, browser and open-source project – and developed working exploits for a significant share of them overnight. Among them are bugs that had gone unnoticed in production environments for 10 to 27 years.

Anthropic has not released Mythos. Instead, the company launched Project Glasswing, a 100-million-dollar programme to help affected technology vendors fix these vulnerabilities before they can be exploited.

The question is not whether others will build similar systems. The question is how long it will take.

What has changed structurally

Volume is exploding

The number of published CVEs has been growing steadily for years. With AI-driven vulnerability discovery, the industry faces a jump of a different order of magnitude. Security teams that already struggle to prioritise critical vulnerabilities will have to work under entirely new conditions.

The exploitation window is collapsing

Traditional patch management was designed around weeks: a CVE is published, the vendor ships a patch, the change management process runs, deployment is scheduled. That window no longer exists in its old form. When AI systems can generate working exploits in hours, response times of days or weeks are no longer a security measure. They are an open flank.

The supply chain becomes the main attack surface

A significant share of the vulnerabilities Mythos found sit in open-source libraries and widely used components. These are embedded in thousands of commercial products, often without users even knowing they have these dependencies. Your attack surface does not end at the code you wrote yourself.

Why visibility is now decisive

In an accelerated CVE environment, the critical bottleneck is not the patch itself. It is the answer to a simple question: which of our publicly reachable assets are affected by this vulnerability?

If you cannot answer that question within hours, you cannot respond within hours. And if you cannot respond within hours, you carry a risk that traditional patch cycles can no longer control.

That requires complete, current visibility of the external attack surface – including the technologies and software versions running on exposed systems. Not as a one-off scan, but continuously.

How blacklens.io helps in this environment

blacklens.io continuously discovers exposed assets and fingerprints the technologies and versions running on them. The Threat Center matches new critical vulnerabilities against this technology inventory on an ongoing basis and shows which external systems are potentially affected. Where a verification template exists, a verification scan checks the match.

That moves the point of response. Answering which systems are affected no longer depends on manual research or outdated asset inventories.