How AI Discovers Zero-Day Vulnerabilities: A Plain-Language Explainer for Security Leaders

Software is built by humans, which means it contains mistakes. Most software mistakes are harmless: a button that does not display correctly, a calculation that rounds the wrong way. Some mistakes are security vulnerabilities: flaws that an attacker can exploit to make software do something it was not supposed to do, such as giving an attacker control of a server or access to data it should not reveal.

A zero-day is a vulnerability that the software vendor does not yet know about. The name comes from the fact that there have been zero days for the vendor to issue a patch. If an attacker finds a zero-day before the vendor does, they can use it freely until someone else discovers it and forces a patch to be released. The window between discovery and patch is the period of maximum exposure.

Historically, zero-days were found by sophisticated human researchers: government intelligence agencies, specialized security firms, and highly skilled independent researchers. Finding a zero-day in a mature, well-audited piece of software typically required weeks or months of dedicated effort by someone with deep expertise in that specific software stack. That scarcity made zero-days rare and expensive.

The modern software stack is too large for any human to fully comprehend. A single enterprise application may contain millions of lines of code, hundreds of third-party libraries, and thousands of configuration options that interact in complex ways. Security researchers reviewing this code face a fundamental cognitive limitation: they can only examine one part of the codebase at a time, and they bring their own blind spots and assumptions about where vulnerabilities are likely to hide.

Human researchers also self-select. Given a target with millions of lines of code, a skilled researcher will focus on the components that historically produce vulnerabilities: parsing code, cryptographic implementations, memory management routines. This is rational, but it means that vulnerabilities hiding in less-examined corners of a codebase may go undiscovered for years. The FreeBSD network file system vulnerability that Glasswing surfaced (CVE-2026-4747) had been present in the codebase for 17 years before Mythos found it.

AI systems like Claude Mythos approach vulnerability discovery without the cognitive constraints that limit human researchers. Mythos can analyze entire codebases simultaneously, maintaining awareness of interactions between components that human researchers would need to context-switch between. It operates continuously, without the fatigue that degrades human analytical performance over long research sessions. And it does not carry the same set of assumptions about where vulnerabilities are likely to be found.

The result is a different kind of coverage. Human researchers go deep into high-probability areas. Mythos goes broad and deep simultaneously, generating and evaluating thousands of vulnerability hypotheses in parallel. The findings that result are not just more numerous. They are different in character: deeper, more complex, and drawn from parts of codebases that had not been systematically examined before.

Project Glasswing, Anthropic's coordinated vulnerability disclosure program, uses Claude Mythos to analyze the attack surface of partner organizations. Mythos examines source code, compiled software, running systems, and the interfaces between them. It does not just look for known vulnerability patterns. It reasons about what an attacker might try, develops hypotheses about how software might fail, and then attempts to construct working exploits to prove or disprove those hypotheses.

Critically, Mythos does not stop at finding a crash or an error condition. It develops full exploit chains that demonstrate what an attacker could actually accomplish. This is the difference between a theoretical vulnerability and a confirmed security exposure. When Mythos reports a finding, it comes with evidence of exploitability, not just evidence of a flaw.

The ExploitBench result (21 out of 41 V8 arbitrary code execution challenges, with every other model scoring zero) is a capability threshold, not a performance metric. It means that Mythos has crossed from academic capability into demonstrated offensive effectiveness on the kinds of challenges that have historically required elite human expertise.

The SCONE-Bench result identifies $35 million in smart contract vulnerability value, demonstrating that the capability extends beyond traditional systems software into financial and blockchain infrastructure. The ExploitGym result (10.5 times more working exploits than Claude Opus 4.6, the next most capable model) shows that the capability gap between Mythos and the previous generation of AI security tools is not incremental. It is categorical.

For your organization, these benchmarks mean that the assumption underlying most patch prioritization frameworks is no longer valid: the assumption that sophisticated, targeted exploitation of complex zero-days requires rare human expertise and significant time investment. Both constraints are dissolving.

The cybersecurity industry has spent two decades building patch management processes calibrated to a world where new critical vulnerabilities emerge slowly and exploitation follows discovery by weeks or months. Glasswing has issued 1,596 coordinated disclosure notifications in 90 days. The vendor ecosystem receiving those notifications was not built to absorb that volume.

The defender's dilemma is not primarily about AI attackers using these vulnerabilities before defenders can patch. It is about the disclosure volume overwhelming the patch prioritization, testing, and deployment pipelines that organizations rely on. An organization that receives ten Glasswing disclosure notifications simultaneously faces triage decisions that its current processes were not designed to handle.

Patch velocity is the metric that matters most right now: how quickly can your organization move from a validated critical finding to a deployed patch in production? For most organizations, the honest answer is measured in weeks. That window is too long when the disclosure volume is this high.

Security leaders briefing boards on this topic will encounter a consistent set of questions. Here are direct answers.

'Are we at risk from Glasswing findings?' If your organization runs any of the nine publicly confirmed CVE-affected software components (FreeBSD, wolfSSL, FFmpeg, Linux kernel, VMM software, browser-based applications, V8-dependent systems, OpenBSD, or smart contract infrastructure), you should assume exposure and verify patch status immediately.

'Is Anthropic sharing these vulnerabilities with attackers?' No. Glasswing follows coordinated disclosure principles: vendors receive private notification and a 90-day patch window before public disclosure.

'Is our security team equipped to handle this?' Probably not at current staffing and tooling levels. The volume and sophistication of AI-discovered findings requires AI-assisted triage and patch prioritization on the defensive side.

'What should we spend money on first?' Patch velocity infrastructure, CVD intake processes, and AI-assisted vulnerability management tooling, in that order.

Three immediate priorities emerge from the Glasswing 90-day results.

First, verify patch status for the nine confirmed Glasswing CVEs in your environment today. These are not theoretical exposures. They are confirmed, exploitable vulnerabilities in widely deployed software. FreeBSD NFS (CVE-2026-4747), wolfSSL (CVE-2026-5194), and the Linux LPE are the highest-priority for most enterprise environments.

Second, establish a CVD intake process if you do not have one. When Glasswing (or any future AI vulnerability discovery program) contacts your organization with a finding, you need a documented process for receiving, triaging, and escalating the notification. The process should include a designated technical contact, a severity assessment framework, and a patch deployment SLA.

Third, brief your board with the correct threat model. AI vulnerability discovery is not a future risk. It is producing confirmed CVEs today. The board discussion should frame this as a patch velocity and disclosure management challenge, not an abstract AI risk scenario.

The high-level guidance above addresses the most immediate priorities. The Mythos Brief provides a practitioner-level defensive framework built around the Glasswing finding distribution.