What happened
Severe cybersecurity vulnerability disclosures (CVEs) spiked in June 2026, with notable organisations publishing approximately 1,500 high- and critical-severity CVEs. This represents a 3.5x increase over the previous monthly record prior to Anthropic's April announcement of Claude Mythos Preview. Mythos Preview, capable of autonomous vulnerability discovery, was used by Project Glasswing partners, including Microsoft, Google, Apple, and AWS, to find and fix bugs. Project Glasswing claims to have identified over 10,000 high- or critical-severity vulnerabilities. OpenAI's Daybreak product also undertakes similar efforts.
Why it matters
Software supply chain risk escalated as AI models demonstrate advanced vulnerability discovery. Procurement teams face increased scrutiny over vendor security claims, requiring deeper validation of codebases. Security architects must now account for both offensive and defensive AI capabilities, accelerating the need for automated vulnerability management. This follows Anthropic's April 2026 announcement that Claude Mythos could autonomously discover software vulnerabilities, shifting the baseline for expected security posture.
