Beyond Penetrate-and-Patch

Tue, 05 May 2026 00:00:00 +0000

In April, Anthropic announced Claude Mythos Preview alongside Project Glasswing, reporting that the model had identified thousands of high-severity zero-day vulnerabilities across every major operating system and web browser, including a 27-year-old bug in OpenBSD.¹ Days later, Mozilla announced patches for 271 vulnerabilities Mythos had surfaced in Firefox — a roughly twelve-fold leap over the 22 bugs Opus 4.6 had found only weeks earlier. Mozilla’s CTO declared, in a blog post titled “The zero-days are numbered,” that defenders finally had a chance to win decisively.² Anthropic, in its own announcement, argued that once the security landscape reaches a new equilibrium, powerful language models will benefit defenders more than attackers.

Software-Security on

Beyond Penetrate-and-Patch