Claude Mythos Finds Bugs Faster Than Teams Can Patch Them

Matthew Green’s August 14, 2026 “going dark” warning is not about encryption blocking network inspection, compliance tools, or parental controls. The Johns Hopkins cryptographer is predicting that AI-assisted software assurance could make remotely exploitable bugs scarce enough to deprive U.S. intelligence and law-enforcement agencies of a major hacking route.

The immediate evidence points somewhere messier: Anthropic says Claude Mythos Preview and its Project Glasswing partners have found more than 10,000 high- or critical-severity vulnerabilities across roughly 50 organizations. That is not a world without bugs. It is a world where defenders may find them faster than they can verify, disclose, and patch them.

Matthew Green, an associate professor at the Johns Hopkins Information Security Institute, made the claim in his August 14 post, “Everything is about to ‘go dark’”. He uses “going dark” in the old law-enforcement sense: authorities losing access to useful investigative evidence—not network operators losing visibility into encrypted traffic.

“I’m concerned that AI is going to make software much too secure.”

That is Green’s deliberately perverse formulation. His concern is that agencies have increasingly relied on targeted device access and remote exploitation as conventional wiretaps became less useful in an encrypted, smartphone-heavy world. If remotely exploitable flaws dry up, he argues, those agencies could return to their familiar demand for legally compelled exceptional access—backdoors, by a more bureaucratic name.

Green’s Two-Year Prediction Concerns Remote Exploits

Green’s post does discuss encryption, but not as a warning that encryption will blind corporate network monitoring or content-filtering systems. Its argument is narrower and more consequential: end-to-end encryption reduced the value of intercepting communications in transit, which made device hacking and remote exploits more important to investigators seeking access to messages and stored data.

His forecast is that well-maintained software could become nearly free of remotely exploitable vulnerabilities within about two years as AI systems become better at finding and repairing flaws. He does not say that all software bugs will vanish, nor that crime will become uninvestigable. The relevant category is the remote bug that lets an attacker compromise a target device without physical access or the target’s cooperation.

That distinction matters. A typo in a web dashboard, a local privilege-escalation bug, and a remotely exploitable browser vulnerability do not carry the same operational value. The last category can be a route into a device that its owner has locked down and whose communications are encrypted.

Green’s two-year timeline is explicitly a prediction, not an observed result. His larger warning is political: if government agencies lose this capability abruptly, the pressure to mandate access mechanisms in encrypted services could return under a new rationale.

It also puts a different light on the struggle between AI companies and the U.S. security establishment. Anthropic has already had a visible conflict with U.S. national-security power; a future argument over whether AI hardening has obstructed lawful hacking would not be a purely technical dispute.

Green’s position is plausible as a direction of travel, but it leaps over the operational problem exposed by current AI security testing: discovery is only the first stage. A model can produce a plausible bug report in minutes; a software supplier still has to determine whether the report is real, assess its severity, develop a safe fix, test it across versions and dependencies, coordinate disclosure, and persuade users to install the patch. Each of those steps can fail independently.

Glasswing’s 10,000-Finding Remediation Backlog

Anthropic launched Project Glasswing as a collaborative defensive program around Claude Mythos Preview, a general-purpose model the company says is unusually capable at cybersecurity work. In its April 7 technical assessment, Anthropic said the model could identify and exploit zero-day vulnerabilities in its tests involving major operating systems and web browsers.

Those are Anthropic’s own results, and the company has a strong incentive to frame an alarming capability assessment as evidence of a frontier model’s power. The company also says more than 99% of the vulnerabilities described in that April assessment remained unpatched and undisclosed, which prevents outsiders from independently examining most individual reports.

By May 22, Anthropic said Glasswing and about 50 partner organizations had found more than 10,000 high- or critical-severity findings. Dividing those two company-reported figures produces a crude but revealing floor of at least 200 serious findings per partner, using 10,000 findings and roughly 50 partners. The actual distribution is surely uneven; the point is the queue.

Anthropic says the limiting factor has moved from discovery to verification, disclosure, and patching. That is a more immediate security risk than Green’s clean two-year endpoint. An organization receiving hundreds of possible high-severity reports is not automatically safer. Until it sorts true positives from false positives and ships fixes, it may simply possess a much more detailed map of its own exposed surfaces.

The project follows coordinated vulnerability disclosure norms: the company describes a roughly 90-day disclosure window, or around 45 days after a patch becomes available. Those delays exist because publishing a flaw before users have upgraded can hand attackers the instructions they need.

Anthropic’s May estimate also began with model-assigned severity ratings. At that point, only 1,752 initially high- or critical-rated findings had been assessed by six independent security firms or Anthropic. That is enough to demonstrate a serious validation workload; it is not enough to treat the raw 10,000 figure as 10,000 confirmed, independently adjudicated vulnerabilities.

Mozilla offers the clearest public example of what the workload looks like when findings can be acted upon. In an April 21 account of its Mythos Preview evaluation, Mozilla said Firefox 150 fixed 271 vulnerabilities identified during the exercise. It also described the strain of processing so many reports at once.

That is the useful correction to both AI doom language and AI security triumphalism. Faster bug-finding can lower risk only if maintainers can convert model output into deployed fixes at approximately the same speed. Otherwise, the model has improved reconnaissance faster than repair.

This is also why evaluations of agentic systems should not be confused with finished autonomous security operations. The same gap appears in agentic sandbox escape and AI security limits: a capable model operating in a constrained test setup is not equivalent to an operator reliably navigating production infrastructure.

Independent Tests Show Both Capability Gains and Validation Limits

There is outside evidence that Mythos Preview represents a genuine jump in some cyber tasks. The UK AI Security Institute, an independent government-backed evaluator, reported that a newer Mythos Preview checkpoint was the first model to complete both of its cyber ranges. That supports the narrow claim that models are improving at multi-step offensive-security exercises.

But the institute also says its cyber ranges and time-horizon benchmarks are imperfect proxies for real-world impact. They run in constrained environments and cannot establish whether the latest performance jump is a durable trend rather than a one-off result. A model completing a range has cleared a designed test; it has not demonstrated a dependable ability to compromise arbitrary production targets.

XBOW, a security company that evaluated the model, reached a similarly mixed verdict in its May assessment. It found Mythos Preview especially strong for source-code auditing—where the model can inspect a defined codebase and search systematically for dangerous patterns—but less self-sufficient at validating vulnerabilities against live systems.

That limitation is not a footnote. Live validation depends on configuration, deployed versions, hidden dependencies, network controls, permissions, rate limits, and the human judgment needed to distinguish an exploitable flaw from a theoretically suspicious line of code. Source review is a search problem. Exploiting a real service is a systems problem.

The emerging picture is therefore sharper than either extreme. Green is not warning that encryption will make enterprise traffic opaque to ordinary inspection tools. He is warning that AI may eventually reduce the supply of remote exploits relied upon by government hackers, potentially reigniting backdoor politics.

For now, though, Mythos Preview’s clearest demonstrated effect is more prosaic and more urgent: it can generate a security triage queue at industrial scale. A shortage of zero-days remains a forecast. A pile of vulnerability reports waiting for humans to confirm and fix is already here.

Key Takeaways

Matthew Green’s “going dark” post concerns intelligence and law-enforcement access through remote hacking, not network traffic inspection.
Green predicts that well-maintained software could lose most remotely exploitable bugs within about two years, but calls this a forecast rather than an observed outcome.
Anthropic says Project Glasswing found more than 10,000 high- or critical-severity findings across roughly 50 partners.
More than 99% of the vulnerabilities in Anthropic’s April 2026 assessment had not yet been patched or publicly described.
Mozilla fixed 271 Mythos-identified vulnerabilities in Firefox 150, illustrating both the model’s utility and the remediation burden.