Microsoft is facing a massive surge in software vulnerabilities discovered by Anthropic's new AI model, Mythos (specifically the Claude Mythos Preview). Through "Project Glasswing," Anthropic granted select organizations access to the tool to identify flaws before adversaries could exploit them. Internal Microsoft documents reveal that in April alone, Mythos uncovered 90 "critical" and 141 "important" bugs in SharePoint. The scale of discovery extends across Microsoft 365, Teams, and Copilot, with engineers struggling to patch flaws as quickly as they are identified. To manage the influx, Microsoft employs a triage system prioritizing critical and important vulnerabilities—such as worms capable of crashing systems—while delaying "moderate" flaws and ignoring "low" severity bugs. However, experts warn that this strategy is risky because AI can chain multiple low-level vulnerabilities to execute high-severity attacks. The sheer volume of work is unprecedented; while Microsoft released over 200 patches in June, they broke that record in July by releasing more than 600 patches. Despite the urgency, the company faces challenges from legacy "technical debt" and a security response center that has historically been understaffed compared to profit-driven product development teams.

Read original