Two downgrades show what source code does not carry. For Temporal Server, Mythos assigned Critical and described an attacker controlling workflows across namespaces. Temporal's maintainers scored the issue 2.3, Low, because exploitation requires an attacker-controlled namespace that already holds a privileged internal credential, and the impact reaches only known workflows [10]. With MinIO, Mythos again said Critical, an outside security firm said High, and MinIO settled on Medium, because the attack needs an existing cluster root JWT and permits read access only [11]. Both preconditions are facts about a deployment rather than about the file the model read.
Of the 27 findings that received CVEs, 14 ratings moved after review, 13 of them down and one up, a flaw in the jq command-line JSON tool that was understated [12]. That is 51.9% of the batch [4].
The volume figures are worth doing in longhand. 1,900 of the 23,019 candidates went to outside reviewers, 8.3% of the pile [1]. 97 fixes landed, 0.42% [2]. Only 1,596 reports reached maintainers, so 304 candidates cleared external review and were still never sent on [5]. Of the 1,451 acknowledged, that leaves 1,354 with no upstream fix recorded as of May 22, 2026 [4][3].
Within the reviewed slice, 90.8% held up as real vulnerabilities [6]. Echo, the supply chain firm that compiled the figures, notes that the 1,900 were unlikely to be a random draw, so the number may describe how good the best candidates were and little else, and Anthropic has not published accuracy for the other 21,000 [7]. Anthropic attributes the drop-off to a shortage of people to check the work [5].
The exploitation result is the part that moves attacker economics, and three conditions travel with it. Anthropic built a benchmark from 50 previously discovered SpiderMonkey vulnerabilities shipping in Firefox 147 and gave each model five attempts per bug, 250 trials [13]. Mythos Preview produced working arbitrary code execution in 181 trials, 72.4%, plus partial register control in 29 more [14]. Claude Opus 4.6 managed two, under 1%, which is where the roughly 90-fold generational figure comes from [15]. Every trial starts from a crash someone else already found, the harness strips Firefox's browser sandbox and other defense-in-depth protections, and Anthropic designed and ran the evaluation, which no outside party has replicated [16]. Separately, Anthropic turned a known Linux kernel use-after-free into a working root exploit for under $2,000 in inference and under a day of runtime, chaining it with a second use-after-free it found in the kernel's traffic-control scheduler [17]. Finding a bug worth acting on still costs a few thousand dollars, with no guarantee the result is high or critical severity [18].
Echo's July 2026 survey of more than 80 senior US security leaders had 37% name detecting more vulnerabilities than they can remediate as the biggest barrier to supply chain security, and 11% name more detection or scanning as their next investment [19]. Anthropic reports the same constraint from the producing end: it has manually confirmed further vulnerabilities and not sent them to maintainers, because its own team and its external partners lack the capacity to review them [20].
