When AI Finds 10,000 Vulnerabilities, Who Is Responsible for the Other 9,999?
Anthropic's Project Glasswing - combining Claude Mythos Preview with automated security analysis - has produced over 10,000 vulnerability findings in widely deployed production software within a month of launch. Of those, roughly 1,700 have been confirmed as valid true positives, with over a thousand classified as high or critical-severity flaws affecting more than a thousand open-source projects.
To put this in human terms: when Mozilla invited Anthropic to test an earlier Claude model against the Firefox codebase in February, it found 22 confirmed security-sensitive bugs. When they ran Mythos Preview against the same codebase, the result was 271 confirmed vulnerabilities - 180 of them rated exploitable by a user simply visiting a malicious page. One evaluation pass. One codebase. A tenfold increase in defensive yield.
Before anyone starts celebrating, it is worth asking the question that the press releases carefully avoid: what happens to the vulnerabilities that are not responsibly disclosed?
The Disclosure Asymmetry
The traditional responsible disclosure model assumes a small number of vulnerabilities discovered by a small number of researchers, who notify vendors, allow time for patching, and then publish. The model is already strained by the volume of modern software complexity. It is not designed for a world where an AI system can confirm a thousand critical flaws in a sitting.
Mozilla chose responsible disclosure. They coordinated with Anthropic, patched the bugs, and published the process as a case study. That is admirable. It is also a choice that required institutional commitment, legal clarity, and a pre-existing relationship between the parties.
What happens when the AI is running for a less conscientious organisation? What happens when the thousand confirmed critical vulnerabilities are found in a competitor's software, in critical infrastructure, in systems whose vendors have no coordinated disclosure process? What happens when the same capability - now documented as achievable - is deployed by a state actor who has no interest in responsible... anything?
A separate collaboration in May 2026 illustrated the dual-use dimension: a team called Calif, working with Mythos Preview, produced a working macOS kernel memory corruption exploit on M5 silicon in five days - bypassing Apple's Memory Integrity Enforcement, a protection Apple spent five years building. Mythos identified the bugs; human expertise was essential for the bypass. Calif disclosed responsibly - demonstrated the exploit to Apple in Cupertino, and the fix already credits both Calif and Anthropic Research in macOS Tahoe 26.5.
The disclosure was exemplary. The capability demonstration was terrifying. Five days to crack five years of security engineering - with responsible actors. The question is what happens with irresponsible ones. The answer is not comforting, and the timeline is not hypothetical.
The Responsible Disclosure Gap
Jeff Kaufman documented what he called AI "breaking two vulnerability cultures." The first culture is responsible disclosure - the norm among security researchers to notify vendors before going public. The second is exploit development culture - the norms around when and how offensive security techniques are shared. AI-accelerated vulnerability discovery is breaking both simultaneously, because the volume changes the incentive structure.
Responsible disclosure is a social norm, not a legal obligation. There is no EU law that requires security researchers to disclose privately before publishing. The Cybersecurity Act creates ENISA's role and the European Vulnerability Database, but does not impose disclosure timelines on researchers. NIS2 imposes reporting obligations on affected operators, not on those who discover vulnerabilities.
When an AI system discovers a thousand critical vulnerabilities autonomously, someone must decide for each one: disclose to whom, on what timeline, with what coordination? At human research pace, this decision is made one vulnerability at a time by researchers who have professional relationships with the security community and reputational stakes in doing it correctly. At AI pace, the decisions must be made programmatically, in bulk, by whoever controls the AI system.
That is a governance question, not a technical one. And the governance framework does not exist yet. Open-source maintainers are already asking Anthropic to slow the pace of disclosures because they cannot patch as fast as the AI can find. The model is drowning the process it was designed to feed.
EU AI Act and Capability Evaluations
The UK's AI Safety Institute has published methodology for evaluating the offensive cyber capabilities of AI systems - specifically assessing GPT-5.5's ability to assist with cyberattacks. This is the regulatory template that the EU will need to adapt for AI Act capability assessments.
Claude Mythos demonstrably falls within the category of AI systems with significant offensive cyber capability. It confirmed over a thousand critical vulnerabilities autonomously. It helped produce a novel macOS kernel exploit. Under the AI Act's General Purpose AI provisions (Article 51 onwards), a model with capabilities at this level may trigger enhanced transparency and security evaluation obligations for Anthropic as the provider.
But here is the paradox the regulation was not built to resolve: Anthropic is using Mythos to improve security. The Mozilla collaboration made Firefox safer. Project Glasswing's stated goal is defensive. The EU AI Act's risk classification framework was not designed to handle AI systems that are simultaneously a cybersecurity capability, a defensive security tool, and a potential offensive weapon - depending entirely on who deploys them and for what purpose. A dual-use system classified solely by its capability rather than its use creates a regulatory environment in which the most responsible deployment is treated identically to the most dangerous one. This is not an oversight - it is a structural limitation of capability-based assessment.
The Clause observes that the regulator wishing to assess the offensive capabilities of an AI system must rely, for the most comprehensive documentation of those capabilities, on the assessment published by the company being regulated. The auditor's most complete source of evidence is the auditee's own press release. The framework is, naturally, unbothered by this.
Liability for AI-Discovered Findings
When Mythos finds a critical vulnerability in production software used by a hospital, and that vulnerability is not patched before someone exploits it using the same or similar AI capability, the liability question is immediate: did the party that knew about the vulnerability (Anthropic, via Project Glasswing) have an obligation to disclose it, and to whom?
This is not resolved by existing law. GDPR Article 32 requires data controllers and processors to maintain appropriate security - but does not impose obligations on third parties who discover that a data controller's software has a security flaw. NIS2 requires operators of essential services to report "significant incidents" but does not require security researchers to report discovered vulnerabilities to operators in advance of exploitation.
The question compounds when the AI system operates at scale. Governance frameworks built on the assumption that stated rules will be followed encounter the same failure mode here: you cannot disclose responsibly by instruction alone if the instruction is one of a thousand decisions being made simultaneously at machine speed. The compliance obligation needs to be architectural, not aspirational - a problem the supply chain is demonstrating from the other direction.
The law is not equipped for a world where a single AI project can produce security intelligence at a volume that exceeds what entire bug bounty programmes produce annually. The governance framework for that world needs to be built deliberately, not discovered after the first major incident where the capability that found the vulnerability is the same capability that was used to exploit it.
A starting point exists, even if the law has not yet reached it: AI systems with demonstrated offensive cyber capabilities should be subject to mandatory disclosure protocols as a condition of deployment - requiring operators to establish and publish responsible disclosure procedures, maintain coordinated disclosure relationships with relevant sector regulators, and report to national competent authorities under NIS2 when AI-discovered vulnerabilities are found in critical infrastructure software.
This will not happen automatically. Regulation tends to follow incidents, not anticipate them.
The ten thousand findings are a preview.