1,596
Verified vulnerabilities
AI-driven vulnerability discovery has crossed a threshold enterprise security programs were not built to absorb. Based on analysis of 1,596 verified vulnerabilities disclosed across 281 open-source projects in 63 days.
Analysis of Anthropic's Claude Mythos Preview coordinated disclosure data · Snapshot May 22, 2026
Coordinated disclosure is working as designed. The problem is downstream: conventional vulnerability management only becomes useful after an advisory is public, after feeds ingest it, and after scanners refresh, then enterprise validation adds weeks more. AI-driven discovery now moves an order of magnitude faster than that pipeline.
The Patch Gap is the window between the moment a vulnerability is privately disclosed to a maintainer and the moment enterprise teams can see, prioritize, validate, and deploy a fix, structurally measured at 90 to 150 days for a typical disclosure.
That is a net deficit of ~23.8 unaddressed disclosures per day. The takeaway is not that every finding is exploitable, it's that the scan-find-patch model can no longer keep pace.
This isn't a normal uptick in discovery volume. It's a shift in shape, from isolated breakthroughs to sustained, high-volume disclosure, operating through a responsible pipeline with external security-firm triage and a 90.8% verified true-positive rate.
1,596 verified vulnerabilities across 281 projects in 63 days, a cadence materially above prior AI-driven discovery programs.
~95% of Mythos disclosures had no public advisory at the snapshot, not a failure of disclosure, but the gap it creates.
Median maintainer acknowledgment was 0.2 days, yet only 6.1% were patched in response. Acknowledgment and remediation are separate bottlenecks.
Even after an upstream fix exists, validation runs 2 to 6 weeks, longer for native, certified, or regulated components, while production stays unpatched.
One upstream vulnerability fans out across distros, container images, and language packages, e.g. a single ImageMagick CVE propagating to 18+ NuGet variants. For defenders, the unit isn't "one finding," it's every reachable affected instance.
A runtime decision loop for operating in the window between disclosure and safely deployed remediation. Four questions decide every disclosure:
Eliminates irrelevant emergency work.
Prioritizes high-risk runtime instances.
Escalates to the emergency lane.
Buys time for safe patch validation.
A severity-only model says patch all 1,200 at once. A runtime decision model narrows it to what's truly exploitable, the difference between panic and prioritization.
Emergency action for 3 instances. Accelerated or standard lanes for the rest. Documented deferral for the 1,178 where the vulnerable path isn't exercised. That is the business value of runtime evidence.
The doctrine is vendor-neutral, but the inputs usually live in separate systems. Tuskira stitches them together fast enough to act during the Patch Gap.
A runtime call-graph and dependency-presence view joining SBOM, eBPF telemetry, and request tracing.
Walks the breach path against the live runtime graph, validates exposure, and emits detection leads.
Proves the deployed defense policy will actually catch the exploit it identified.
Pushes the resulting indicators and control guidance into the tools you already run.
The full methodology, all five findings, the pre-CVE signal model, the CISO quarterly checklist, the bug-class-to-D3FEND map, and the expanded nginx worked example.
Tuskira Research found that the rate of Mythos vulnerability discovery outpaced the rate of patching by 16.5x despite 90% maintainer acknowledgement of the issue.
J.P. Morgan · Eye on the Market: Patchmageddon · Michael Cembalest · July 22, 2026 · p.16, n.33
View the citation