The Emerging Patch Gap: What Anthropic Mythos Data Reveals About AI-Driven Vulnerability Discovery and Enterprise Remediation

AI is finding software vulnerabilities roughly 16.5× faster than they are being visibly remediated.

That is the central finding from Tuskira Research’s analysis of 1,596 verified vulnerabilities disclosed through Anthropic Mythos across 281 open-source projects over 63 days. The implication is not that AI finds more bugs. It is that the operating model security teams have relied on for decades, wait for the CVE, prioritize by severity, patch, no longer matches the pace of discovery.

Read the full research report →

Why we analyzed Anthropic Mythos data

When AI-assisted disclosure programs began surfacing vulnerabilities in volume, the interesting question was never whether AI could find bugs. It clearly can. The question was whether the rest of the ecosystem could keep up, and what that meant for the enterprises sitting downstream of every affected open-source project.

Anthropic’s Mythos program gave us a rare, well-documented dataset to test that question against. We analyzed 1,596 verified vulnerabilities disclosed through Mythos across 281 open-source projects over a 63-day window, then combined that disclosure data with Tuskira’s own exposure and exploit-path analysis across enterprise environments. That let us look not just at what was found, but at how a finding travels from an upstream project into the tools, containers, and distributions that companies actually run.

What Anthropic Mythos revealed

The Mythos data exposed a measurable timing gap between AI-driven discovery and enterprise remediation. We call that window the Patch Gap, and the evidence for it is consistent.

Roughly 95% of the disclosures had no public advisory at the time of analysis. Most of these vulnerabilities were not yet visible through the channels enterprises depend on: CVEs, the NVD, GitHub advisories, or commercial scanners. The CVE feed is no longer the starting line. By the time a vulnerability reaches traditional enterprise workflows, the decision window may already be open.

If your program waits for a CVE before it begins prioritization, it is already behind the pace of AI-driven discovery.

Discovery outpaced visible remediation by roughly 16.5×. AI-driven discovery is now producing vulnerabilities faster than the ecosystem can safely remediate them. That ratio is the Patch Gap expressed as a single number.

Only 6.1% of disclosures had been patched, despite 90.9% maintainer acknowledgment. This is the most important nuance in the data. Maintainers are not ignoring these reports. They are acknowledging almost all of them. They simply cannot write, review, and ship fixes at the rate AI generates findings. That is a capacity problem, not an attention problem, and capacity problems do not resolve on their own.

The resulting Patch Gap can stretch 90 to 150 days. Between a private disclosure and a deployed production patch, an enterprise can remain exposed for months, often with no public signal that the exposure exists.

One upstream issue can generate 18 or more downstream package alerts. A single vulnerability in a widely used library multiplies across package ecosystems, distributions, containers, and enterprise tooling. The raw discovery count understates the real operational load.

From 1,200 systems to 3

The most useful thing in the data is not a statistic. It is what happens when you stop ranking by severity and start asking for evidence.

The report walks through a representative nginx WebDAV vulnerability disclosed through Mythos, across an enterprise fleet of 1,200 instances. A severity-only model treats all 1,200 as emergencies, because the CVE is critical and the software is everywhere. Runtime evidence tells a very different story:

The fleet narrows fast: 1,200 nginx instances, 720 with the relevant module compiled, 96 with the vulnerable methods enabled, 22 with the vulnerable configuration path, and only 3 that are public, unauthenticated, and unprotected by a WAF.

Three instances require immediate action. The rest are routed into accelerated, standard, or defer-with-evidence lanes, and the team can document exactly why 1,178 instances do not need emergency patching for that specific exploit path. That is the operational difference between panic and prioritization, and it is the difference between severity and evidence.

What security teams should do differently

The instinct, looking at a 16.5× gap, is to patch faster. That instinct is correct and insufficient. You cannot out-patch a discovery engine running well ahead of you, and you cannot do it by waiting on advisories that exist for only about 5% of what is being found.

The more durable conclusion is that severity alone is no longer a usable way to prioritize. A CVSS score tells you how bad a vulnerability could be in the abstract. It tells you nothing about whether the vulnerable code is reachable in your environment, whether it is exposed, whether it is being exploited, or whether a compensating control already neutralizes it. When discovery outpaces remediation this badly, ranking by severity just produces a longer queue you will never finish.

What changes the math is evidence. For any finding, four questions decide whether it deserves attention today: Is it reachable? Is it exposed? Is it being exploited? Is it controlled? Answer those, and a backlog of thousands collapses into the handful that can actually hurt you, exactly as it did from 1,200 nginx instances down to 3.

The bottom line

AI did not create the Patch Gap. It made it impossible to ignore.

Discovery is now permanently capable of moving faster than remediation, and the gap between them is measurable, persistent, and exploitable. The organizations that adapt will not be the ones that patch the fastest. They will be the ones that know, with evidence, which vulnerabilities actually matter first.

The full report includes the complete methodology and sources, all of the findings, the pre-CVE signal model, the expanded nginx worked example with compensating controls, and the four-pillar Patch-Gap Defense Doctrine for closing the gap.

Read the full research report →