Anthropic's bug-hunting AI outpaces Microsoft's patching speed

Project Glasswing, revealed publicly in April, represents a fundamental shift in how software vulnerabilities are discovered. By handing Anthropic's Mythos AI to select organizations including Microsoft, the goal was to identify and patch flaws before adversaries—including nation-states like China—gained access to comparable AI tools. The internal Microsoft meeting in mid-May exposed the tension at the heart of this strategy: the AI is working too well. In just one month, Mythos identified 231 bugs of critical or important severity in SharePoint alone, forcing engineers into what managers called "a mad dash" to close the gap.

The scale of the challenge extends beyond the raw numbers. Vinh Nguyen, the NSA's former AI chief, introduced a critical insight: in the AI era, vulnerability triage—the traditional medical-triage model of treating the sickest patients first—may be fundamentally broken. When low and moderate-severity bugs can be chained together to create high-severity exploits, deferring them is no longer safe. Yet Microsoft's internal documents indicate the company planned to address moderate-severity flaws "eventually" and made no mention of low-severity bugs. This gap between what AI can now expose and what humans can patch reflects not just a staffing problem but a strategic one.

The Five Eyes intelligence alliance warned in late June that the window to fix vulnerabilities before adversaries caught up would close "in a matter of months." But leaked Microsoft records suggest that window may already be closing or closed. By July 14, Microsoft released patches for over 600 bugs—more than three times the previous June record—signaling the company is in reactive mode. The broader implication extends beyond Microsoft: the software industry, including open-source projects maintained by volunteers, now faces an unprecedented volume of newly exposed flaws. As one security expert put it, vulnerability management has shifted from "drinking from a garden hose" to "drinking from a fire hose."