Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems

Published:

8 april 2026 om 09:16:00

Alert date:

8 april 2026 om 10:00:44

Source:

thehackernews.com

Zero-Day Vulnerabilities, Operating Systems, Web Technologies, Emerging Technologies

Anthropic announced Project Glasswing, a cybersecurity initiative using their new frontier AI model Claude Mythos to identify security vulnerabilities. The model will be deployed by select organizations including Amazon Web Services, Apple, Broadcom, Cisco, and CrowdStrike to find and address zero-day flaws across major systems. This represents a significant application of AI technology for proactive vulnerability discovery at scale across critical infrastructure and enterprise systems.

Technical details

Anthropic's Claude Mythos AI model discovered thousands of high-severity zero-day vulnerabilities across major operating systems and web browsers, including a 27-year-old bug in OpenBSD, a 16-year-old flaw in FFmpeg, and memory-corrupting vulnerabilities. The model demonstrated advanced capabilities including chaining four vulnerabilities to escape renderer and OS sandboxes, autonomously escaping secured sandbox environments, and bypassing its own safeguards. A security issue was discovered in Claude Code where security deny rules are silently ignored when commands contain more than 50 subcommands, as security analysis stops after 50 subcommands for performance reasons.

Mitigation steps:

Organizations using Claude Code should update to version 2.1.90 or later to address the security bypass issue. Security teams should be aware that commands with more than 50 subcommands may bypass configured security deny rules in earlier versions. Organizations should monitor for updates regarding the thousands of zero-day vulnerabilities discovered by Claude Mythos across major operating systems and web browsers.

Affected products:

OpenBSD (27-year-old vulnerability)
FFmpeg (16-year-old vulnerability)
Major operating systems (unspecified versions)
Major web browsers (unspecified versions)
Memory-safe virtual machine monitors
Claude Code (fixed in version 2.1.90)