Key Findings
The end-to-end window from private disclosure to enterprise patch-in-production can stretch 90 to 150 days.
Patch ManagementEnterprise SecurityMythos
A single ImageMagick CVE can propagate to 18+ NuGet variants via Magick.NET.
CVE
95% of Anthropic Mythos disclosures have no public advisory and are not visible through CVE, NVD, GitHub advisory, or scanner-driven workflows.
Vulnerability VisibilityVulnerability ManagementMythos
AI-driven discovery outpaces visible Mythos-attributed remediation by roughly 16.5x, with about 25.3 disclosures per day versus about 1.5 patches per day.
Vulnerability DiscoveryPatch ManagementMythos
Only 6.1% of Mythos disclosures are marked as patched, despite 90.9% maintainer acknowledgment.
Patch ManagementOpen SourceMythos
In the first 63 days of the Anthropic Claude Mythos Preview, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects.
Vulnerability DiscoveryOpen SourceSoftware SecurityMythos