Clearing Mythos Preview's 6,105 open findings at 97 fixes per two months takes a decade

Take both numbers at face value and the backlog has a schedule. Subtract the confirmed fixes from the findings and 6,105 items are still open ^[14]. At 97 confirmations every two months, clearing 6,105 runs to about 126 months, call it ten and a half years, and that assumes Mythos Preview stops finding things ^[15].

The two figures are not counted the same way. The 6,202 is an estimate of what was identified; the 97 is what was confirmed remediated ^[2]. Confirmation takes a second event after the fix: someone checks that a maintainer shipped it, and the result gets back to the discloser. A fix that nobody confirms never shows up in the 97. So 1.6 percent ^[16] is a floor on the remediation rate.

Anthropic's own framing points at the input side. The company said that "even at our relatively slow pace of disclosures, Mythos Preview is adding to an already-overloaded security ecosystem" ^[3]. The disclosure rate is throttled by choice, and the identification rate is what produced 6,202 ^[2].

The Log4Shell comparison in the dev.to account carries the argument. Remediation of CVE-2021-44228 ran for months because discovering every transitive instance across complex build graphs was the hard part, not because patching a library was hard, and a model can map those transitive paths quickly while patch delivery stays human-bound ^[9]. What is left once discovery gets cheap is the gated sequence: ticket, architecture review, compliance gate, regression testing, deployment approvals, scheduled release ^[8]. Those steps take the same time however early the input arrives.

The post's mobile example is an illustration, and the most useful part of the post. An app receives a deep link such as `mybank://transfer?to=<account>&amount=<value>` while cold-booting. The URL router processes the payload parameters before the authentication completion callbacks finalise, and the transfer flow writes those parameters into active state before access controls block the view controller ^[10]. No linter or unit test flags it ^[11]. The claim underneath is that tooling evaluating whole execution paths and state graphs at once compounds isolated correctness bugs into exploitable attack chains ^[12].

For the 1.6 percent to say anything about your own backlog, your fixes would have to be confirmed the way a third-party discloser confirms them, and your dependency set would have to look like foundational open source maintained by people who never asked for the report. An in-house team patching its own code has a shorter loop and nobody to notify. The median resolution time in the Verizon DBIR is the figure such a team can compare itself against ^[6].

All of this reaches the reader through one dev.to post, which attributes its figures to Anthropic, Gartner, Verizon and Mandiant ^[13]. Gartner's warning, as quoted there, is about capacity: "without corresponding improvements in governance, security operations, and remediation capabilities, AI-driven vulnerability discovery may outpace organizational defenses" ^[5].