Jonathon's AI Wiki

ProPublica — Mythos vs Microsoft's Patching Capacity

7 min read

Source: Anthropic’s New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. — ProPublica, Renee Dudley (research by Doris Burke), 2026-07-29, “Zero Trust” series. Surfaced via Anthropic 1v9w69u (link post, u/propublica_).

ProPublica, working from a recording of a mid-May Microsoft meeting and internal documents, reports that Anthropic’s Claude Mythos Preview — provided to roughly 50 Microsoft engineers under Project Glasswing — is finding security bugs faster than Microsoft can patch them, leaving engineers in what one manager called “a mad dash.” The piece is the concrete, adversarial-journalism counterpart to Anthropic’s own defensive framing: the same capability that lets Mythos harden critical software also produces a finder-vs-fixer capacity imbalance that the industry’s standard triage model was not built to absorb. Its sharpest technical claim is that Mythos can chain low-severity bugs into high-severity attacks — which means the low- and moderate-severity flaws Microsoft is deferring are not safely deferrable.

Key Takeaways

  • “A mad dash.” At a mid-May meeting at Microsoft’s Redmond HQ, dozens of engineers discussed Project Glasswing. Asked whether Mythos “live up to the hype,” a manager said “Yes” — and that Mythos was surfacing bugs faster than the company could patch them.
  • Concrete SharePoint numbers. In April alone, Mythos uncovered 90 “critical” and 141 “important” bugs in SharePoint; the first half of May found even more. The SharePoint team was told it “will be busy for months” — critical bugs first, important ones in August, then roughly 300 “moderate” bugs.
  • The June 1 window. Engineering manager Hans Andersen framed May 31 as “the day when the rest of the world will have caught up” — i.e., when publicly available models would match Mythos’s finding power. An engineer’s summary: “if it’s released on June 1, then on June 2 the adversaries will have our bugs?” — “Yep.” This echoes a late-June Five Eyes joint statement warning the fix-it window would close “in a matter of months.”
  • Triage under strain. Microsoft is patching critical/important first (standard ER-style triage), plans to “eventually” address moderate, and the documents make no mention of “low.” Across Microsoft 365, Teams, and Copilot, Mythos found hundreds of critical/important bugs since early 2026; as of mid-May most were unpatched.
  • Bug chaining breaks the triage logic. Vinh Nguyen — Anthropic senior technical adviser, CFR senior fellow, and former NSA chief AI officer/chief data scientist — warns Mythos “can chain four low-level flaws, and that can equal a high severity… the current triage strategy may be underpricing risks.” Deferring low/moderate bugs is therefore itself a risk.
  • Record-shattering Patch Tuesday. June: 200+ patches (then an all-time high). July 14: 600+ patches — only seven low/moderate, one under active exploitation. Zero Day Initiative’s Dustin Childs: “the bug apocalypse has fully descended upon us.”
  • A structural, not just Microsoft, problem. Ben Edwards (vulnerability data scientist): “It was like drinking from a garden hose on the jet setting before, and now it’s like drinking from a fire hose.” J. Michael Daniel (ex-Obama cyber adviser, Cyber Threat Alliance president): “Nobody has really figured out how to deal with this… Our tech debt is coming due.” Open-source volunteers face the same flood.

The finder-vs-fixer imbalance

  • Discovery scaled; remediation did not. The core dynamic: an AI finder throughput jumped by an order of magnitude while human patching/verification capacity stayed roughly fixed. Microsoft’s Security Response Center is described as “perennially understaffed,” fielding hundreds-to-thousands of reports monthly before the AI surge — a constraint ProPublica ties to Microsoft’s cost-center-vs-profit-center philosophy (security patches as cost, new products as profit).
  • The deferral trap. Standard triage (fix the most dangerous first, defer the rest) is rational per-bug but unsafe in aggregate once bugs can be chained — the deferred long tail becomes exploitable in combination. This is the report’s most decision-relevant claim for anyone running vulnerability management.
  • Access as a head start, on a clock. Glasswing slides state the goal was to “harden critical services before publicly available models catch up,” with ~50 Microsoft FTEs given Mythos access; a “What’s Next” slide predicts continued case volume “as public tools catch up.” The defensive value is real but time-boxed — the advantage decays as comparable capability diffuses.
  • Source code is not the moat. A staffer’s hope that adversaries “don’t have the source code” was corrected by colleagues: “It might not be this week’s source code. But they’ve got source code. It’s out there.” Microsoft says it designs security “on the expectation that determined adversaries may gain access to code.”

Company responses

  • Microsoft stood by its triage approach (decisions based on exploitability and customer impact), said chaining “has long been considered as part of vulnerability assessment,” downplayed the May 31 deadline (“accelerated targeting… is not a new phenomenon”), and said it has “invested heavily in both people as well as AI-powered triage solutions.” It declined to say how many bugs it has patched since the presentation, and does not discuss internal staffing.
  • Anthropic declined to comment.

Why it matters

  • Independent, document-grounded corroboration of the Glasswing thesis — and its downside. Where the Mythos system card and Anthropic’s 10,000+ vulnerability program figures come from the program side (every incentive to report the largest defensible number), this is adversarial journalism built on a meeting recording and internal slides — a different and harder-to-dismiss evidence class. It confirms the capability and documents the remediation bottleneck the program framing understates.
  • The verification/remediation bottleneck is the recurring 2026 pattern. The same “AI produces faster than humans can absorb” curve appears in Mythos cryptanalysis (a month of human review per result) and in the verification frontier generally. Finding is cheap; fixing and verifying are the scarce resources.
  • Operator takeaway for defensive security. If AI finders are entering your stack (yours or an adversary’s), per-bug triage is no longer sufficient — chaining means the whole severity spectrum needs remediation capacity, and patch cadence, not detection, is the binding constraint. Nguyen’s blunt version: “There’s no alternative. The patients are coming in fast and furious.”

Open Questions

  • How many bugs has Microsoft actually patched? Microsoft declined to say; the mid-May “most unpatched” snapshot is the last hard number in the piece.
  • Have any Mythos-found bugs been exploited in the wild? ProPublica says it’s unclear, while noting some attackers already use AI to automate attacks and “Mythos-like tech.”
  • Did the June 1 / May 31 “catch-up” prediction hold? The claim that public models would match Mythos’s finding power by end of May is testable against subsequent public tooling and CVE trends — worth a refresh.
  • Does triage actually change? Microsoft told ProPublica it is “always going to be reevaluating” whether lows/moderates should be upgraded “with these AI systems” — whether that becomes policy is unresolved.

Graph View

Backlinks