129,000 Vulnerabilities Discovered: Anthropic Unveils the Impressive Results of Claude Mythos

Claude Mythos is living up to its promises. This Tuesday, October 6, Anthropic therefore announced the expansion of its Cyber Verification Program, the program that opens its most powerful AI models to cybersecurity specialists. More organizations will now be able to use Claude Mythos to look for vulnerabilities in computer code. When Mythos was released last April, Anthropic had chosen to reserve the AI for a handful of partners, carefully selected, as part of an initiative called Project Glasswing.This cautious approach was intended to prevent malicious individuals from exploiting generative AI to carry out cyberattacks.

We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.

Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.

We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming.

https://t.co/blaJtvxhJh

— Anthropic (@AnthropicAI) October 6, 2026

Also read: Claude found 2 flaws in algorithms deemed indestructible—it’s a first, and it changes everything

More than 130,000 vulnerabilities

Six months later, Claude Mythos has clearly delivered on its promises. According to Anthropic, Project Glasswing partners identified at least 129,000 verified software vulnerabilities between April and July 2026. Anthropic’s analyses of open-source software added 5,500 vulnerabilities between April and October. In May, one month after deployment, Anthropic was still claiming only 10,000 vulnerabilities uncovered by its AI. More than 33,000 of these vulnerabilities are rated “critical” or considered “high” severity.

Anthropic considers this initial assessment to be very conservative. Indeed, it is based on a survey conducted among only some of Glasswing’s partners.In fact, it is likely that more vulnerabilities were identified during the period. The company estimates that the number of failures is “at least five times” higher. Several Anthropic partners say that Mythos has accelerated the hunt for vulnerabilities by several months, or even several years. In recent months, Claude notably uncovered a security vulnerability nearly 30 years old.

Also read: 16 million computers affected – Claude reveals the existence of a 9-year-old Linux vulnerability

Three access levels for Claude Mythos

Buoyed by Mythos’s success, Anthropic is opening the taps a little further. The new Cyber Verification Program combines two programs launched six months ago, including Glasswing and the first Cyber Verification Program. From now on, three access levels will be introduced. All levels provide access to Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1.

Named Defense, the first level covers malware analysis, incident response, and vulnerability validation. It is open to security teams, operators of critical infrastructure, such as regional hospitals or municipal services, maintainers of open-source projects, and researchers who have previously reported vulnerabilities.

The Red Team level adds penetration testing, namely simulations designed to test a system’s defenses. It is reserved for organizations.Finally, the Specialized tier is characterized by more flexible restrictions. This tier is reserved for a small group of organizations authorized to test critical systems, such as electrical grids, aviation systems, telecommunications networks, or interbank transfers. Each member is subject to review by the US government.

That’s not all. Organizations enrolled in the Cyber Verification Program must accept that their data is retained by Anthropic. The American startup wants to be able to sift through the data to detect potential malicious uses. To reassure its partners, Anthropic will deploy a solution called Enterprise Frontier Safeguards this fall, enabling customers to store their data on infrastructure under their control.

“Cybersecurity is inherently dual-use: the same tools that enable a security team to detect and fix a vulnerability can also be used by a malicious actor to exploit it,” says Anthropic, justifying its precautions.

👉🏻 Follow tech news in real time: add 01net to your Google sources and subscribe to our WhatsApp channel.