Anthropic's Claude Mythos Can Exploit Zero-Days Across Major OS and Browsers

Anthropic has unveiled Claude Mythos Preview, a frontier AI model capable of identifying and exploiting zero-day vulnerabilities across every major operating system and web browser—a capability that security researchers say fundamentally alters the threat landscape for enterprise Java environments.

"During our testing, we found that Mythos Preview is capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and every major web browser when directed by a user to do so," Anthropic stated in its disclosure.

The model can chain multiple subtle vulnerabilities together to create functional exploits, outperforming both human security researchers and existing automated scanning tools. During validation testing, Mythos uncovered a 27-year-old remote denial-of-service vulnerability in OpenBSD's TCP SACK implementation dating to approximately 1999—a bug that had evaded detection for nearly three decades.

Restricted Access, Defensive Focus

Mythos is not publicly available. Access is limited to select partners under "Project Glasswing," an initiative focused on defensive security work with critical software infrastructure providers. The restriction acknowledges the dual-use risk: the same capabilities that help defenders identify vulnerabilities could enable sophisticated attacks if widely accessible.

For the Java ecosystem, the implications are acute. The OpenJDK Vulnerability Group (OVG) manages security patches for the open-source Java runtime, releasing updates on a fixed schedule: the third Tuesday of January, April, July, and October. This quarterly cadence, designed for a slower threat environment, now faces pressure from AI systems that can analyze entire codebases at machine speed.

The Patching Imperative

Enterprise Java teams must prioritize Critical Patch Updates (CPUs) over Patch Set Updates (PSUs). According to Azul, which produces Zulu builds of OpenJDK, roughly one in four PSUs traditionally introduces a regression that forces organizations to wait for yet another patch. CPUs contain only security fixes on a stable base and are not affected by these regressions.

Azul Core (Zulu builds) typically makes updates available within one hour of the Oracle CPU embargo being lifted, providing a narrow but critical window for deployment. Security teams relying on legacy Java versions or delaying patch cycles face heightened risk as AI-powered tools reduce the time between vulnerability discovery and active exploitation.

The Bigger Shift

The emergence of Mythos reflects a broader transformation in cybersecurity. Traditional scanning tools like Black Duck and Snyk struggle to detect the subtle, chained vulnerabilities that large language models can identify through holistic codebase analysis. Compounding the problem is the rise of AI-assisted coding tools like Cursor and GitHub Copilot, which introduce opaque, AI-generated code into production environments without systematic security review.

For organizations running Java in production, the message is clear: rigorous JDK update strategies are no longer optional. The window between AI-discovered vulnerability and weaponized exploit has collapsed from months to potentially hours. In this environment, staying current with CPUs and avoiding regression-prone PSUs may be the difference between resilience and compromise.