The latest generation of AI models has changed the game when it comes to finding security vulnerabilities, for both the people defending software and the people trying to exploit it. It’s worth understanding what’s happening, because it’s a big part of why we keep emphasizing the importance of keeping your devices updated.
In April 2026, Anthropic announced Mythos Preview, an AI model with an unusual ability to find security flaws in software. Unlike earlier AI security tools that tended to flood analysts with false positives, Mythos has proven it can find real vulnerabilities that have gone undetected for decades, including a 27-year-old bug in OpenBSD, an operating system that’s long been regarded as one of the most secure around.
Alongside Mythos, Anthropic launched Project Glasswing, a collaboration with around 50 partners including Apple, Microsoft, Google, Amazon, and several major financial institutions. The goal is to find and fix vulnerabilities in critical software before similar AI capabilities end up in the wrong hands. As Firefox engineers put it, “The current moment is a perilous one, but also full of opportunity. Let’s work together to secure the internet.”
Why This Matters
The scale of what’s already been found is striking. Within a month of Project Glasswing’s launch, Anthropic reported that partners had collectively identified more than 10,000 high- or critical-severity vulnerabilities in their software. Several partners saw their bug-finding rate increase by more than tenfold.
Mozilla, the organization behind Firefox, published a compelling example of what Mythos can do. It identified and fixed 271 vulnerabilities in Firefox 150, more than ten times the number found in Firefox 148 using the previous generation of AI tools. Of those 271 bugs, 180 were rated high-severity, meaning they could be exploited through everyday activity like browsing a webpage. (The chart below shows higher numbers because it includes bugs from other sources and versions.)
Mozilla’s results stand out not just for the volume of bugs found, but for their quality. Many of these vulnerabilities had survived years of traditional security testing without ever being caught.
How Apple Fits In
Apple is a founding partner in Project Glasswing, which is consistent with how seriously the company takes security. Its vertical integration, controlling everything from chip design to the operating system to the App Store, gives it a structural advantage when it comes to building security in from the ground up. The newest M5 Mac chips and A19 iPhone and iPad chips, for example, include Memory Integrity Enforcement (MIE), a hardware-level protection designed specifically to stop memory corruption exploits.
That said, even cutting-edge protections aren’t bulletproof. In May 2026, security researchers at Calif.io demonstrated the first public macOS kernel memory corruption exploit on M5 silicon. Working with Mythos Preview, they built a working privilege escalation exploit in just five days, targeting hardware protections that Apple spent five years developing.
An Arms Race Against Time
Right now, Anthropic controls access to Mythos. But equivalent capabilities will inevitably become more widely available. OpenAI, Google, and other AI developers are likely already building similarly capable models, and some of those may end up accessible to bad actors.
The stakes look different depending on whether we’re talking about new software or code that’s already out in the world. For new code, defenders have a real advantage. They can scan for vulnerabilities before anything ships and catch bugs that manual testing would never find.
For software already running on billions of devices, the picture is harder. Attackers only need to find one exploitable bug. Defenders need to find and fix all of them. And attackers move fast. They don’t need to worry about breaking features, scheduling releases, or getting sign-off from other teams. They can act the moment they find something. As the Zero Day Clock illustrates, the window between a vulnerability being discovered and being exploited has shrunk dramatically. What once took months now takes days, and within a year or two, it’s expected to happen in minutes.
This transition period is where the risk is highest. AI is finding vulnerabilities in existing code faster than patches can be written and deployed. The Zero Day Clock site has a call to action with 10 suggestions for how the industry and society should rethink cybersecurity to get ahead of this threat.
Keep Installing Updates
For most people, the best defense is also the most straightforward: keep your devices updated. That’s always been good advice, but it matters more now than ever. Apple’s updates increasingly include patches for vulnerabilities that were discovered with AI assistance. Here’s what to do:
- Enable automatic updates. Don’t leave it to chance. On iPhone or iPad, go to Settings > General > Software Update > Automatic Updates. On a Mac, go to System Settings > General > Software Update, click the ⓘ button, and turn on all the switches. If your organization has an update policy, check with IT before making changes.
- Factor security into hardware decisions. The main reason to upgrade should always be functionality, but newer hardware generally comes with stronger built-in protections, which is worth keeping in mind.
- Replace devices that no longer get updates. Hardware that’s stopped receiving security patches is an increasing liability. This goes beyond your iPhone or Mac. Network equipment, printers, and smart home devices like cameras and doorbells all need to stay current too.
The long-term outlook is actually encouraging. As AI-powered security tools become standard, developers will catch far more bugs before software ever ships. But in the near term, keeping your devices up to date is one of the most important things you can do.
(Featured image by iStock.com/Thinkhubstudio)
