Claude Mythos: Critical Vulnerabilities Are Outpacing Patches

Anthropic's warning: what has changed

On May 23, 2026, Anthropic issued a warning that struck the international tech community. The model Claude Mythos Preview, running as part of Project Glasswing, has passed 10,000 critical vulnerabilities identified in system software. Yet the most worrying figure isn't the total number. It's the speed.

The pace at which bugs are discovered consistently outstrips development teams' ability to produce and release fixes. This creates a time gap, potentially weeks or months long, in which vulnerabilities are known but still unpatched. That window is a real opening for malicious actors.

According to The Decoder, Anthropic explicitly stated that no company, itself included, currently has sufficient safeguards to prevent misuse of these advanced models.

Anatomy of the problem: why AI finds bugs faster

Latest-generation language models like Claude Mythos Preview analyze source code at a scale that is impossible to replicate manually. They can review millions of lines of code in parallel, spotting both known vulnerability patterns and entirely new variants.

What's more, these systems don't just look for exploits that are already cataloged. They use contextual reasoning to identify combinations of conditions that look harmless on their own. As a result, new classes of vulnerabilities emerge that traditional SAST and DAST tools miss.

The structural problem is that human patch management is sequential and bound by organizational constraints. An AI model, by contrast, works asynchronously and knows no bureaucratic bottlenecks. This asymmetry is the heart of the risk Anthropic describes.

The immediate impact on Italian SMEs

Large companies have dedicated Security Operations Centers and budgets to respond quickly to new threats. Italian SMEs, on the other hand, often work with limited IT resources and drawn-out software update cycles. The exposure gap is therefore structurally wider.

In particular, three types of SMEs are the most vulnerable in this scenario:

• Companies using unmonitored open source software: third-party libraries built into your tech stack may contain vulnerabilities that Claude Mythos already knows about but maintainers haven't yet patched.
• Retailers with e-commerce infrastructure: payment and order management systems are high-value targets. So every unpatched vulnerability window is a direct risk to customer data.
• B2B SMEs with access to enterprise suppliers' systems: they often serve as an attack vector into larger organizations. As a result, their security matters for the entire ecosystem they operate in.

According to analysis by McKinsey Digital, SMEs that fail to update their cybersecurity practices in response to the evolution of AI tools risk becoming the weak link of entire supply ecosystems.

The high-risk transition period: a practical reading

Anthropic uses the phrase high-risk transition period to describe the current phase. That wording deserves attention. This isn't a future or speculative risk. It's a present condition, backed by real data.

Much like when the first automated fuzzing tools spread in the 2000s, bringing advanced AI into vulnerability research shifts the balance between attackers and defenders. But today's scale and speed have no comparable precedent.

Gartner has already listed AI-accelerated threat discovery among the top technology risks for organizations in 2026-2027. So this isn't an isolated alarm from Anthropic, but a trend recognized across the analyst community. You can dig deeper into this context in the Gartner Top Technology Trends research.

What to do now: concrete priorities if you manage digital infrastructure

Faced with this scenario, waiting is not an option. At SHM Studio, we recommend that SMEs tackle the problem on three distinct but interconnected levels.

Level one — Inventory and visibility: you need to know exactly which software components are in use, including third-party dependencies and open source libraries. Without an up-to-date inventory, any patch management strategy is blind by design.

Level two — Response speed: software update cycles need to get shorter. You also need emergency patching procedures for critical vulnerabilities, kept separate from regular release cycles. This takes a minimum of IT governance, even in small companies.

Level three — AI exposure assessment: if your company uses or integrates AI models in its processes, you need to map the points of contact between those systems and your critical infrastructure. Then define a clear policy on which data and systems can be exposed to third-party AI tools.

If your SME wants to explore how to integrate AI tools securely into its digital processes, our team offers dedicated consulting through the AI services from SHM Studio.

The work still in progress: nobody has the definitive solution

One point is worth stressing because it often gets overlooked in the public debate. Anthropic didn't present this warning as someone else's problem. On the contrary, it counted itself among the companies without adequate safeguards.

This admission carries real weight. It means the AI industry as a whole is operating in a regulatory and technical gray area. So blindly trusting the security claims of AI vendors, even the most reputable ones, is a risky stance today.

The right response, then, isn't to give up on AI, but to adopt it with critical awareness. SMEs weighing AI tools in their workflows, from digital marketing management to SEO optimization, need to build security into the decision-making process rather than treat it as a separate topic.

Outlook: where the market is heading over the next 18 months

Anthropic's Glasswing project involves about 50 partners. That number will grow. Meanwhile, other AI labs, including OpenAI, Google DeepMind and Meta AI, are developing similar automated vulnerability research capabilities.

As a result, the cybersecurity market will face growing pressure to automate on the defensive side too. AI-assisted patch management and automated remediation tools will become standard components of corporate security stacks, no longer premium options reserved for large organizations.

For Italian SMEs, this means the cost of accessing advanced security tools will fall over time. In the short term, though (the next 12-18 months), the gap between how fast vulnerabilities are discovered and how fast companies can respond will remain critical.

Finally, it's reasonable to expect new regulation. The NIS2 directive, already in force in Europe, requires cyber risk management from SMEs operating in sectors considered essential. The landscape created by Claude Mythos Preview will likely speed up enforcement of these obligations.

To stay up to date on how these scenarios evolve and what they mean for SMEs' digital strategies, you can read the SHM Studio blog or contact our team directly.

For more technical insights on the topic, see the MIT Technology Review analysis of AI's impact on cybersecurity.

If you run digital campaigns and want to protect the data you collect through tools like Google Ads or LinkedIn Ads, API integration security deserves specific attention. Likewise, if you invest in AI-assisted SEO copywriting, you need to look closely at which company data the models you use will process. Finally, secure web design remains a fundamental prerequisite for any sustainable digital strategy.