Claude Mythos Shows How AI Can Turn N-Day Bugs Into Working Exploits Within Hours

Anthropic says its Claude Mythos Preview model can turn newly patched vulnerabilities into working exploits within hours, raising fresh concerns about the time organizations take to deploy security updates. The company detailed the findings in an Anthropic study published on June 8, 2026.

The research focused on N-day vulnerabilities, which are flaws that have already been disclosed and patched by vendors but remain unpatched on many user systems. These bugs matter because the patch itself can reveal what changed, giving attackers a path to reverse-engineer the weakness.

Claude Mythos Preview is not a public consumer model. Anthropic says it is being used through Project Glasswing, a defensive cybersecurity initiative involving major technology and infrastructure partners.

Anthropic Says the Patch Gap Is Shrinking Fast

Anthropic tested large language models on 18 recent SpiderMonkey security patches in Firefox. SpiderMonkey is Firefox’s JavaScript engine, and Anthropic selected it because browser JavaScript engines often sit near the start of real-world browser exploit chains.

The model received limited material meant to resemble what an attacker could learn after a patch became public. That included the public code difference, the affected component, the severity rating, and vulnerable and patched builds of the standalone JavaScript shell.

Claude Mythos Preview produced proof-of-concept crashes for 14 of the 18 Firefox patches. The first proof-of-concept arrived in about 12 minutes, and 13 arrived within 40 minutes. The model then turned eight of those cases into working code-execution exploits in roughly 12 hours.

Test target	What Anthropic tested	Claude Mythos Preview result
Firefox SpiderMonkey	18 security patches from Firefox 148 and 149	14 proof-of-concept crashes and 8 working code-execution exploits
Windows kernel	21 local elevation-of-privilege vulnerabilities	18 proof-of-concept crashes and 8 full SYSTEM escalation chains
Patch rollout window	Time between public patch data and broad deployment	Exploit creation completed before many systems would receive or enforce updates

Windows Kernel Tests Showed the Same Risk Without Source Code

The Windows test was harder because the source code was not available. Anthropic gave the model patched and vulnerable binaries, public debug symbols, a decompiler output, a function-level diff, and Microsoft’s public advisory text.

The test covered 21 Windows kernel vulnerabilities from the January and February 2026 Patch Tuesday releases. Microsoft’s Windows update release cycle explains that monthly security updates normally arrive on the second Tuesday of each month, while out-of-band updates are reserved for exceptional cases.

Claude Mythos Preview generated proof-of-concept crashes for 18 of the 21 Windows kernel bugs within six hours. It also built eight complete privilege-escalation chains that moved from a low-privilege user account to SYSTEM-level control in Anthropic’s test harness.

• The Firefox test showed rapid exploit creation when source diffs were available.
• The Windows test showed similar speed even when the model had to work from compiled binaries.
• Anthropic said public Claude models could also build some exploits when safeguards were turned off, though at lower success rates.
• The study did not claim that the model performed a full attack campaign.

Some Bugs Rated as Unlikely to Be Exploited Still Worked

Anthropic said Microsoft had rated 14 of the 21 Windows vulnerabilities as either “Exploitation Less Likely” or “Exploitation Unlikely.” Claude Mythos Preview produced proof-of-concept crashes for 13 of those 14 vulnerabilities.

The model also achieved a full privilege-escalation chain for one vulnerability that had been rated “Exploitation Unlikely.” Anthropic said this suggests exploitability ratings may need to change as AI-assisted exploit development improves.

The point is not that every low-rated vulnerability will become a mass exploitation event. The warning is narrower: ratings built around human reverse-engineering timelines may underestimate what strong AI systems can do once a patch becomes public.

Traditional assumption	What the Anthropic test suggests
Patch diffing requires scarce expert labor	AI can automate much of the initial analysis
Exploit development may take weeks	Some working exploits can appear within hours
Lower exploitability ratings reduce urgency	AI may change how exploitability should be scored
Monthly patching gives defenders time	The patch gap may now be too long for high-risk systems

Firefox Shows Both the Risk and the Defensive Opportunity

Mozilla has already been testing frontier AI models for defensive security work. In April, the company said an early version of Claude Mythos Preview helped identify 271 vulnerabilities fixed in Firefox 150, according to a Mozilla security post.

That matters because the same class of capability can help both attackers and defenders. Attackers may use AI to turn patches into exploits faster. Vendors can also use AI to find bugs earlier, validate patches, and scan old code that traditional tools missed.

Anthropic’s latest N-day analysis says Firefox was a relatively favorable case for defenders because it updates automatically and can download fixes in the background. Even then, the patch gap was still wide enough for fast exploit generation in testing.

Windows Autopatch Highlights the Deployment Challenge

Enterprise patching takes time because companies need testing, staged rollouts, restart planning, and user disruption controls. Microsoft’s Windows Autopatch documentation gives an example where broad-ring devices wait seven days before downloading a quality update and can face a forced restart around day 10.

That kind of delay has long helped IT teams manage risk and stability. Anthropic argues that AI-driven exploit creation changes the balance, especially for critical vulnerabilities and internet-facing systems.

The issue grows more serious for industrial systems, healthcare devices, embedded hardware, and IoT products. These systems often depend on fixed maintenance windows, vendor-controlled firmware, or uptime requirements that slow down emergency patching.

• Prioritize patches for exposed and high-value systems first.
• Reduce approval delays for security fixes that affect exploited or easily weaponized components.
• Use hotpatching, staged rings, and emergency update paths where available.
• Track asset ownership so vulnerable systems do not wait in unmanaged queues.
• Use exploit mitigations and isolation when immediate patching is not possible.

Claude Mythos Is Being Kept Behind Defensive Access Controls

Anthropic says Claude Mythos Preview has found thousands of high-severity vulnerabilities across major operating systems, browsers, and other important software. The company also says it does not plan to make the model generally available at this stage.

Through Project Glasswing, Anthropic is giving selected partners access for defensive work. The company has also committed usage credits and donations to open-source security groups as part of the initiative.

The controlled rollout reflects the dual-use nature of the technology. A model that can find and help fix serious bugs can also help create working exploits if an attacker has access, tooling, and enough context.

What Security Teams Should Do Now

The immediate lesson is that patch speed needs to improve. Microsoft’s monthly security update model remains important, but some organizations will need faster processes for high-risk bugs.

Defenders should also look beyond patch timing. Moving critical code to memory-safe languages, reducing exposed attack surface, enabling exploit mitigations, and improving detection can lower risk when immediate patching is not realistic.

Mozilla’s Firefox security work shows the other side of the trend. AI-assisted tools can help software vendors find and fix flaws before attackers exploit them, but that benefit depends on fast triage and engineering capacity.

Priority	Recommended action
Patch management	Shorten emergency patch windows for high-risk vulnerabilities
Asset inventory	Identify exposed systems and owners before patches arrive
Exploit mitigation	Use memory safety, control-flow protections, sandboxing, and least privilege
Detection	Monitor for post-patch exploitation attempts and abnormal privilege escalation
Software development	Use AI-assisted code review and security testing before release

Anthropic’s research does not mean every patch will become an exploit within hours. It does mean defenders should stop assuming that exploit creation remains a slow, expert-only process. For many organizations, the patch gap has become the main risk window.

Microsoft’s quality update rollout guidance shows why deployment controls matter, but Anthropic’s work suggests those controls need faster emergency paths. The organizations that adjust first will have a better chance of using AI as a defensive advantage instead of facing it as an attacker multiplier.

FAQ