IC Technology & Cyber — 2026-07-30

Anthropic Mythos AI Overwhelms Microsoft With Bug Discoveries as Five Eyes Warns Window Closing for Adversaries

BLUFMicrosoft will likely exceed 400 CVEs at its August 11 Patch Tuesday, confirming the remediation gap Five Eyes warned is closing before adversaries acquire comparable discovery tools.

A recording of a mid-May Microsoft internal meeting on "Project Glasswing," reviewed by ProPublica, shows engineering manager Hans Andersen telling staff the company was in "a mad dash" to patch vulnerabilities that Anthropic's Claude Mythos Preview model was surfacing faster than teams could fix them 1. A presentation slide cited by ProPublica showed Mythos found 90 critical and 141 important bugs in SharePoint in April alone, with hundreds more critical or important flaws identified across Microsoft 365, Teams and Copilot as of mid-May, most still unpatched 12. Microsoft's July 14 Patch Tuesday release covered more than 600 bugs, up from a prior high of over 200 in June, according to Zero Day Initiative lead Dustin Childs 1. In late June the Five Eyes intelligence alliance issued a joint statement warning that the window for fixing flaws before adversaries acquire comparable AI tools would close within months 13. Microsoft told ProPublica it is investing in staffing and AI-powered triage but declined to say how many bugs have been patched since May 1.

Analysis
Microsoft's patch cadence, single-source via ProPublica with only secondary amplification, is becoming the leading indicator of AI-driven vulnerability discovery outrunning enterprise remediation industry-wide. Microsoft will likely address more than 400 CVEs at its August 11 release, extending growth from roughly 200 in June to over 600 in July. Confidence is moderate: volume has grown across three consecutive cycles, but visibility into how many Mythos-flagged bugs Microsoft has actually resolved since May remains limited. Microsoft's own framing casts the "mad dash" as urgency-building around a familiar triage challenge rather than evidence of a genuine capability gap. A sustained count above 400 would confirm the remediation gap is widening rather than narrowing, telling CISOs and CISA to staff for a permanent structural shortfall rather than a one-time July catch-up, while roughly 300 moderate-severity SharePoint bugs sit unaddressed until fall.

3 sources

Anthropic's New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. - ProPublica
AI is finding bugs faster than Microsoft can fix them - Neowin
Patch Tuesday, Wednesday and Every Other Day, Too - Security Boulevard