activesearch
Book a call
Book a call

Written by Jan Schneider

AI finds security flaws faster than they can be fixed

Software has bugs, and some of them are security vulnerabilities. Finding them used to be painstaking work for a small number of specialists. Since this spring it has been clear that AI models can take on that work at scale. That is good news for anyone defending software. It also changes what matters inside companies.

What happened

In April 2026 the AI company Anthropic announced Project Glasswing. A model called Mythos Preview, which is not publicly available, searched widely used software for weaknesses. According to the company, it found thousands of previously unknown high-severity vulnerabilities, including in every major operating system and browser.

Two examples show how thorough the model was:

  • In OpenBSD, an operating system known for its security, it found a 27-year-old bug that let an attacker crash a machine remotely.
  • In FFmpeg, a library that processes video in countless programs, it found a 16-year-old bug in a line of code that automated testing tools had run through around five million times.

Anthropic only gives the model to a selected group of partners, among them Microsoft, Google, Apple, Amazon Web Services, Cisco, CrowdStrike and the Linux Foundation. The idea: defenders should get a head start before such capabilities spread.

Mozilla has shown what this looks like in practice. Its team checked Firefox 150 with the model, found 271 vulnerabilities and fixed them. Mozilla wrote that it had so far found no category of flaw that humans can find and the model cannot. In May, Anthropic reported that its partners, by then around 50, had together found more than 10,000 high or critical vulnerabilities.

Putting it in context

Most of the figures come from Anthropic itself. Individual findings, such as Mozilla’s, are independently confirmed. The direction is clear all the same: in finding vulnerabilities, AI models now work at the level of experienced specialists, and much faster.

That moves the bottleneck. A vulnerability is only closed once a person has verified it, reported it to the vendor and the vendor has shipped a patch. That part does not scale at the same pace. And a flaw is only fixed for you once the update is actually installed.

On top of that, what only selected partners use today will spread, sooner or later to attackers as well. Security researchers already report criminal groups using AI in their attacks.

What this means for your company

For most companies the most important consequence is unspectacular. Vendors now find and fix their flaws faster. You only benefit if you install the updates.

  • Install updates promptly. Operating systems, browsers, firewalls, VPN gateways and server software first. Turn on automatic updates wherever you can.
  • Know what is running. An up-to-date list of your systems and programs is what tells you what needs an update.
  • Retire what is left over. Software without vendor support no longer gets patches. What is no longer needed should come off the network.
  • Ask your providers. If an IT service provider looks after your systems, ask how quickly they install critical updates.

None of this is new. What is new is that the time between a flaw becoming known and being exploited is likely to shrink. A dependable update process today puts you in a good position for that.

Sources