Topic
Model capability at finding vulnerabilities in source code and chaining exploitation stages, measured by CyberGym, ExploitBench and ExploitGym.
VulnCheck counted Chrome CVEs up 563% and GitHub-issued CVEs up 476% year to date in a May 14, 2026 post. It calls the rise consistent with AI-assisted bug finding, but whether the volume lasts is unknown, so exploitation data still sets patch order.
Reality
Anthropic's OSS Scanner sends maintainers Mythos findings before its researchers review them, with about 6,000 of 29,000-plus candidates triaged. The service is free and opt-in, and reports carry reproduction steps and proposed fixes where available.
Reality
FFmpeg 8.1.2 fixes CVE-2026-8461, a CVSS 8.8 heap out-of-bounds write in the libavcodec MagicYUV decoder that JFrog found. A dev.to post-mortem says a crafted .avi thumbnailed by a file manager reaches it, so anything linking libavcodec needs a version check.
Reality
Microsoft's October Patch Tuesday fixes a record 1,413 flaws, including Windows Shell zero-day CVE-2026-96951 that attackers already exploit. Malwarebytes reports Microsoft expects AI to bring more fixes each month, so triage has to key on exploitation.
Reality
Chainguard unveiled Harness, which has frontier models such as Claude Mythos 5.1 attack a live build and reports only flaws that reproduce. It arrived with Workspaces and Checks for coding agents and an expansion of Libraries to Go and .NET.
Perspective Coverage
4 publishersReality
Ripple paid Veria Labs the $250,000 program maximum for an XRP Ledger bug that could have minted about 18.45 trillion XRP. ZachXBT called the sum too small and warned it could tempt the next finder to exploit instead of report.
Perspective Coverage
3 publishersReality
XRP Ledger developers disclosed an integer-overflow bug in xrpld 3.4.0 and earlier that could have minted XRP beyond its 100-billion supply cap. The patch skipped the validator vote, so the cap's defence rested on one team and on node operators upgrading fast.
Perspective Coverage
8 publishersReality
Anthropic's Claude flagged more than 29,000 candidate open source vulnerabilities in six months, and upstream projects have patched 516 of them. Maintainers praise the reports, but each fix still ships only as fast as the project that tests and releases it.
Reality
Anthropic expects more than 90% of the unreviewed vulnerability reports its new OSS Scanner sends to open source maintainers to be real. Opt-in projects get findings faster and take on the work of catching the errors, such as wrong severity ratings.
Perspective Coverage
6 publishersReality
Anthropic has launched OSS Scanner, a free opt-in service that sends open-source maintainers AI vulnerability reports no human has reviewed. The triage Anthropic skips falls to maintainers, so downstream teams should expect more upstream findings that a person still has to confirm.
Reality
Red Hat says its Lightwell project has fixed more than 400 novel vulnerabilities in foundational Java libraries since launching in June. Teams running pinned, older Java dependencies should expect more fixes to land, and Red Hat is selling backports built for their exact versions.
Perspective Coverage
7 publishersReality
Google's October 6 Chrome desktop update fixes 247 security flaws, four of them rated Critical. The fixes apply when Chrome relaunches, so a browser nobody closes keeps running the vulnerable build until someone restarts it.
Reality
Anthropic's Frontier Red Team has disclosed 6,157 open-source vulnerabilities and knows of upstream patches for 516. The gap sits with maintainers, whose capacity Anthropic's own policy treats as the ceiling on how fast it files reports.
Reality
VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.
Perspective Coverage
4 publishersReality
Epic has stopped most product development for roughly six weeks while it fixes MyChart flaws that an AI model uncovered, according to TechCrunch. No list of affected portal setups is public yet, so hospitals cannot check theirs against one.
Perspective Coverage
3 publishersReality
Google Threat Intelligence Group counted 10,740 vulnerability disclosures in August, more than double the monthly figure at the start of 2026. Exploitation is rising more slowly, so the first call on any budget reopened this quarter is triage capacity.
Reality
Core Lightning told operators on October 2 to upgrade from version 26.06.7 or older after reports that attackers are targeting unpatched nodes. MetaMask's precautionary exit from Lido that week lost no reported funds but will likely forgo rewards on ETH that can take up to 45 days to return.
Reality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
Palo Alto Networks pointed Anthropic's unreleased Mythos at its own systems and found 75 vulnerabilities in a month, against a usual rate below five. The defense business it built on that result depends on Anthropic's model and on customers choosing a security vendor over the lab.
Reality
The EUR2.1m pre-seed is roughly 0.16% of what 360 Capital and PranaVentures manage between them - a check sized to option a research method, before Bynario has a finished security platform to bet on.
Reality
Invest · September 26, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Product · August 18, 2026 · Confirmed3 publishers
Build · August 16, 2026 · Confirmed5 publishers
Leadership · September 9, 2026 · Confirmed2 publishers
Build · September 10, 2026 · Confirmed2 publishers