Tuskira

The end-to-end window from private disclosure to enterprise patch-in-production can stretch 90 to 150 days.

A single ImageMagick CVE can propagate to 18+ NuGet variants via Magick.NET.

95% of Anthropic Mythos disclosures have no public advisory and are not visible through CVE, NVD, GitHub advisory, or scanner-driven workflows.

AI-driven discovery outpaces visible Mythos-attributed remediation by roughly 16.5x, with about 25.3 disclosures per day versus about 1.5 patches per day.

Only 6.1% of Mythos disclosures are marked as patched, despite 90.9% maintainer acknowledgment.

In the first 63 days of the Anthropic Claude Mythos Preview, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects.