Anthropic · Claude · Mythos · The Register
Anthropic-linked CVEs pile up, attackers mostly shrug
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
Of 225 flaws found by Glasswing and tracked by VulnCheck researcher, one has confirmed exploitation in the wild.
Key facts
- As of Monday, the CVE count is 225, and one, a critical SQL injection bug in Ghost ( CVE-2026-26980 ), has been exploited in the wild
- In one of these, 1Password’s research team produced and analyzed 6,080 patches developed by two frontier models: OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8
- Another study by app security shop Veracode found that across more than 100 models and 80 coding tasks, the average security pass rate for AI-generated code was 56 percent
- Despite the concern that advanced AI models’ bug-hunting prowess will lead to attackers exploiting more newly uncovered CVEs, fewer than 0.5 percent of the vulnerabilities linked to Anthropic
Summary
Despite the concern that advanced AI models’ bug-hunting prowess will lead to attackers exploiting more newly uncovered CVEs, fewer than 0.5 percent of the vulnerabilities linked to Anthropic or Project Glasswing are being batttered in the wild, according to VulnCheck security researcher Patrick Garrity. Garrity began tracking CVEs attributed to Project Glasswing, Anthropic’s initiative to give select partners access to its Claude Mythos Preview model, shortly after the AI company announced the program in April. At the time, Anthropic said the new model was too risky to release publicly because its bug-finding and exploitation skills surpass all but the most skilled humans. Garrity’s Anthropic CVE tracker maintains a list of vulnerabilities credited to the Anthropic team and/or Project Glasswing and also checks these CVEs against the company's known exploited vulnerabilities index "to get a better read on the real Glasswing ‘danger factor.