Claude Mythos Discovered Thousands of Zero-Days: Here Is What That Means for Your Endpoints

Most security headlines about Claude Mythos Preview focused on the AI. The more operational question is what it means for the endpoints running across your organization right now.

According to Anthropic, Mythos Preview surfaced more than 10,000 high- or critical-severity vulnerabilities across critical software systems, including flaws in every major operating system and every major web browser. That figure came from just the first weeks of Project Glasswing.

Endpoints are where those vulnerabilities live. Servers, laptops, desktops, and the agents running on them all carry the operating systems, browsers, libraries, and applications that Mythos examined.

When AI can find previously unknown flaws faster than patch cycles can close them, the question becomes concrete: how quickly can you identify which endpoints are exposed, apply a fix or mitigation, and verify it worked?

What Is Claude Mythos Preview?

Claude Mythos Preview is Anthropic's restricted-access frontier AI model, used exclusively through Project Glasswing to find and analyze software vulnerabilities at a scale and speed that human security researchers cannot match.

Anthropic describes it as a general-purpose model whose cybersecurity capabilities emerged as a downstream consequence of improvements in code, reasoning, and autonomy. It autonomously identifies zero-day vulnerabilities, reverse-engineers binaries, and constructs working exploits. Anthropic chose not to release it publicly because of the risk those capabilities pose in unrestricted use.

Project Glasswing launched in early April 2026 with 12 named founding partners - including Apple, AWS, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, NVIDIA, and Palo Alto Networks — alongside approximately 40 additional organizations, bringing the initial cohort to roughly 50. The results were significant: Cloudflare alone found 2,000 bugs, 400 rated high or critical severity. Partners' overall bug-finding rate increased by more than a factor of ten. Among the confirmed findings: a 27-year-old flaw in OpenBSD's TCP stack, a 16-year-old vulnerability in FFmpeg, and a critical certificate-forging flaw in wolfSSL (CVE-2026-5194, CVSS 9.1). Bugs that survived decades of human review, found in weeks of AI-assisted scanning. (CVE-2026-5194, CVSS 9.1). Bugs that survived decades of human review, found in weeks of AI-assisted scanning.

Why Thousands of Zero-Days Change the Endpoint Conversation

Endpoints run the software Mythos examined. Every Windows, macOS, and Linux server, every managed laptop, every browser session sits on the exact stack where these flaws appear. The risk picture now has three distinct layers that defenders need to track separately:

• Zero-days: previously unknown flaws with no vendor patch yet available. Mythos surfaced thousands of these. Defenders cannot patch through normal channels, compensating controls are the only option while waiting for vendor response.
• Disclosed but unpatched vulnerabilities: publicly known flaws where a patch exists but has not yet been deployed. The window between disclosure and full deployment is where most exploitation occurs.
• Known exploited vulnerabilities: flaws actively being used by adversaries right now, catalogued on the CISA KEV list. These carry the highest immediate risk regardless of CVSS score.

Each layer requires a different response. Endpoint vulnerability exposure across all three is the operational surface where Mythos-class AI changes the stakes most directly.

Each layer requires a different response. Managing endpoint vulnerability exposure across all three is the operational surface where Mythos-class AI changes the stakes most directly.

AI Vulnerability Discovery Compresses the Defender's Timeline

Traditional vulnerability management assumed a workable gap between discovery, disclosure, patch release, and exploitation. The Mythos results show that assumption no longer holds. According to the Verizon DBIR 2026, organizations take an average of 43 days to fully remediate a known exploited vulnerability. Mythos Preview built working exploits from disclosed CVEs in under one day in testing. That 43-day gap is where most breach opportunities exist.

The practical response is to reduce the time endpoints remain exposed. Cloudflare's analysis of working with Mythos Preview during Project Glasswing concluded that the difficulty is no longer finding bugs. It is verifying, triaging, disclosing, and patching them faster than adversaries can independently develop similar capabilities.

What This Means for Known Vulnerabilities and Patch Backlogs

There is a temptation to treat zero-day discoveries as a separate problem from day-to-day patching. It works the other way. AI that can find new flaws in mature software can also help adversaries prioritize which old, known weaknesses remain unpatched in enterprise environments.

A backlog of critical CVEs becomes more dangerous when AI lowers the cost of building working exploits. Unpatched systems that were previously low-priority because exploitation was technically difficult become higher-priority targets when AI assistance removes that barrier. End-of-life applications and misconfigured endpoints carry more risk than they did two years ago.

The starting point is mapping: which critical and actively exploited vulnerabilities apply to which endpoints, and which of those are internet-facing or business-critical?

HCL BigFix Remediate maps exposures against the CISA KEV list and MITRE ATT&CK threat groups, so remediation concentrates on what adversaries are actively using, more actionable than CVSS scores alone.

What This Means for Endpoint Drift and Compliance

A patch deployed is not the same as a patch that stuck. Endpoint configuration changes constantly. Devices go offline, reconnect, and miss updates. A compensating control deployed for a zero-day may be quietly reversed by a software reinstall or a policy exception days later. A periodic scan running weekly or monthly will miss that window entirely.

This matters more in a Mythos-class AI era because the safe operating window is shorter. HCL BigFix Compliance enforces controls directly at the endpoint using 50,000+ pre-built checks mapped to CIS, DISA STIG, PCI DSS 4.0, HIPAA, NIS2, and DORA.

Autonomous enforcement detects drift and restores the configuration without a manual ticket. For security teams working toward zero trust posture, continuous drift remediation is the operational layer that keeps endpoints within security baselines between formal audit cycles.

What Security Teams Should Do Now

Four actions deliver the most defensible improvement in the near term.

1. Know what is running. Maintain real-time software inventory across your endpoint estate.

• Real-time endpoint visibility, what software is installed, which version, and which systems are internet-facing, is the foundation. Periodic scans leave gaps. The exposure during those gaps is where risk accumulates.

2. Prioritize against CISA KEV and MITRE ATT&CK, not CVSS scores alone.

• A vulnerability on the KEV list is being actively exploited right now. It moves to the front of the queue regardless of theoretical severity. Map your endpoint inventory against KEV and ATT&CK before setting remediation order.

3. Apply compensating controls for zero-days while waiting for a vendor patch.

• Blocking the vulnerable port, disabling the vulnerable service, or restricting outbound connections can reduce exploitability or limit exposure while a patch is in development. BigFix can deploy these controls across 120+ operating systems, including air-gapped and OT environments.

4. Report exposure reduction in business terms.

• Ticket counts and scan percentages do not translate to board-level evidence. How long did a critical vulnerability remain open on a business-critical endpoint?
  HCL BigFix CyberFOCUS Protection Level Agreements measure and report that metric automatically.

From Unknown Flaws to Provable Protection

Boards do not need a briefing on every AI-discovered zero-day. They need to know whether the organization can reduce exposure when new risk appears, and whether the speed of that response is adequate.

The reporting gap most security programs face is translation, not data. Protection Level Agreements automatically measure exploitable vulnerability exposure time against agreed organizational thresholds, giving security, IT, auditors, and executives a shared view: what was fixed, how quickly, which assets missed target, and whether the overall trend is improving. The question boards will ask is not 'What is Mythos?' It is 'Can we act fast enough?'

BigFix CyberFOCUS delivers PLA reporting alongside KEV-aligned prioritization and remediation workflows.

Ready to Reduce Endpoint Exposure Faster and Prove It?

HCL BigFix helps enterprise IT and security teams find, prioritize, remediate, and validate endpoint exposure reduction across complex environments. See how it works in the Mythos era.

Talk to an expert today

Frequently Asked Questions

What is Claude Mythos Preview?

Claude Mythos Preview is Anthropic's restricted-access frontier AI model, used through Project Glasswing to autonomously discover software vulnerabilities at a scale and speed that human researchers cannot match. Anthropic has not made it publicly available because its offensive capabilities pose risks in unrestricted use.

Did Claude Mythos discover thousands of zero-days?

Yes. Anthropic and its Project Glasswing partners found more than 10,000 high- or critical-severity vulnerabilities in critical software systems within weeks of launch. Confirmed examples include a 27-year-old OpenBSD bug and a certificate-forging flaw in wolfSSL (CVE-2026-5194, CVSS 9.1).

Why do AI-discovered zero-days matter for enterprise endpoints?

Endpoints carry the operating systems, browsers, and applications where these flaws live. AI-discovered zero-days add a risk layer that conventional CVE scanners cannot address, there is no patch yet. Organizations need real-time inventory of what is running, compensating controls to limit exposure while vendors develop patches, and validation that those controls have applied across managed endpoints.

How should enterprises reduce endpoint exposure in the Mythos era?

Maintain real-time software inventory, prioritize against CISA KEV and MITRE ATT&CK rather than CVSS scores alone, apply compensating controls for zero-days to reduce exploitability while waiting for vendor patches, validate remediation across managed endpoints, monitor for configuration drift, and report exposure time in business terms using Protection Level Agreements.

What is a compensating control for a zero-day vulnerability?

A compensating control is a configuration change that can reduce exploitability or limit exposure while teams wait for a vendor patch. Examples include blocking the vulnerable network port, disabling the vulnerable service, or restricting outbound connections an exploit payload would need. These controls do not remove the underlying flaw but can significantly reduce the risk window.

How can security teams prove remediation to boards and auditors?

Protection Level Agreements automatically measure exploitable vulnerability exposure time against agreed organizational thresholds. They produce a shared view of risk reduction: which assets are within target, how long exposure persisted, and whether the overall trend is improving. PLAs convert operational patch data into evidence that boards, auditors, and cyber insurers can evaluate.