Microsoft rushes to fix bugs found by Anthropic’s Mythos AI

In short: Microsoft engineers say an Anthropic AI model is finding serious software bugs faster than Microsoft can fix them.

What's going on

Microsoft has been testing an AI model from Anthropic called Mythos as part of “Project Glasswing,” according to a recording and internal documents reviewed by ProPublica and reported by Ars Technica. The goal is to spot security weaknesses before criminals or hostile governments find the same problems.

In an internal May meeting, a Microsoft manager said the tool, “Claude Mythos Preview,” was uncovering bugs faster than teams could patch them. A slide from that presentation said that in April, Mythos found 90 “critical” bugs and 141 “important” bugs in SharePoint, Microsoft’s widely used software for sharing documents and managing work.

Microsoft said it is prioritizing the most dangerous issues first, which is common in security work. It is similar to an emergency room focusing on the sickest patients first. But experts warned that in an AI-driven world, several smaller issues can be combined into a bigger attack, like using a few weak locks on different doors to reach the same room.

Recent public patch releases show the scale of the workload. Microsoft fixed over 200 bugs in June, then over 600 in mid-July, a new record. Most of those were rated “important” or “critical.”

What to watch

Security experts have warned there may be only a short window between defenders getting these AI tools and attackers getting similar ones. The key question is whether software companies can change how they staff and prioritize fixes so they can patch not just the biggest holes, but also the smaller ones that can be chained together.

Source: Arstechnica