CVE Severity Spike After Claude Mythos Preview Release — Epoch AI Data
Epoch AI's analysis of publicly disclosed CVEs reveals a dramatic spike in high- and critical-severity vulnerabilities following Anthropic's April 2026 announcement of Claude Mythos Preview. In June 2026, 21 notable organizations — including Microsoft, Google, Apple, AWS, Oracle, Cisco, and others — disclosed approximately 1,500 high- and critical-severity CVEs. That's more than 3.5 times the previous monthly record set before Mythos Preview's release.
Key Findings
- 3.5x spike in high/critical CVEs in June 2026 over pre-Mythos monthly record.
- Anthropic's Project Glasswing — whose partners include Microsoft, Google, Apple, and AWS — has already discovered over 10,000 high- or critical-severity vulnerabilities, many not yet publicly disclosed.
- OpenAI runs a similar effort called Daybreak.
- Data is drawn from the public CVE repository, filtered to 21 reputable vendors to avoid noise.
Method & Caveats
Epoch filtered CVE.org data to only submissions from 21 named organizations (e.g., Microsoft, Google, Apple, Adobe, Oracle, etc.). This avoids capturing low-quality submissions from smaller vendors. The tracked metric is disclosed CVEs — not found but undisclosed ones. Anthropic claims Glasswing alone has identified over 10k, so the disclosed numbers may be a fraction of total discoveries. The increase could also partly reflect more research interest, not just model capability.
Impact for Developers
If you maintain or depend on software from major vendors, expect a wave of high-severity patches. The data suggests AI-assisted vulnerability discovery (both ethical and adversarial) is accelerating the zero-day discovery-to-patch cycle. Keep your dependency scanners updated and prioritize patching critical CVEs from these sources.
📖 Read the full source: HN AI Agents
👀 See Also
Open Source AI Tools Pose Security Risks Through 'Illusory Security Through Transparency'
A Reddit post warns about malware disguised as open-source AI agents and tools, where malicious code can be hidden in large codebases that users assume are safe because they're on GitHub. The post describes how 'vibe-coding' and autonomous AI agents condition users to run unknown programs without review.
Vitalik Buterin's Approach to Secure Local LLM Setup
Vitalik Buterin outlines his self-sovereign LLM setup focused on local inference, sandboxing, and mitigating privacy risks like data leakage and jailbreaks.
KnightClaw: Local Security Extension for OpenClaw Agents
KnightClaw is a drop-in extension that intercepts messages before they reach OpenClaw agents, providing an 8-layer hybrid detection system and egress redaction. It runs entirely local with zero telemetry and is MIT licensed.
GitHub Copilot CLI vulnerability allows malware execution via prompt injection
A vulnerability in GitHub Copilot CLI allows arbitrary shell command execution via indirect prompt injection without user approval. Attackers can craft commands that bypass validation and execute malware immediately on the victim's computer.