Anthropic says Project Glasswing has used Claude Mythos Preview and roughly 50 partners to identify over ten thousand high- or critical-severity software vulnerabilities in its first month. Cloudflare reported 2,000 bugs across critical-path systems. Mozilla tested the model on Firefox and fixed 271 vulnerabilities. Anthropic also says its own scans of open-source projects have surfaced thousands of likely severe flaws, with outside security firms confirming a high share of the inspected cases. The public numbers read like an inventory of debt hidden in routine code.

The strange lesson sits in the queue after discovery. Finding flaws used to be the hard part. Anthropic now describes a different bottleneck, where humans must reproduce findings, contact maintainers, write reports, build fixes, and wait for users to install them. Each ticket needs judgment before it becomes a patch. The machine has made weak code visible at a speed the software world cannot yet absorb. Security becomes a race between exposure and repair, with maintainers standing in the narrow space between a discovered hole and an exploited one.