On October 27, 2026, Anthropic’s ExploitBench page listed a model that drove 21 of 41 Chrome V8 CVEs to arbitrary code execution. Every other model tested scored zero.
Anthropic’s unreleased Mythos Preview reached arbitrary code execution on 21 of 41 Chrome V8 CVEs, 51.2%, while no other tested model managed a single one, per the ExploitBench page updated October 27, 2026. One day earlier, on October 26, Anthropic reported that open-weight GLM-5.3 completed 50 of 410 end-to-end exploits against Mythos Preview’s 56. The frontier lead is six attempts wide.
Those two numbers come from the same organisation, published a day apart, and they do not sit comfortably together. On the narrow V8 benchmark, Mythos Preview is in a category of one. On the broader end-to-end exploit development benchmark, an open-weight model is within 1.5 percentage points of it.
The V8 result is the more alarming of the two. Chrome’s V8 engine is the JavaScript runtime inside every Chromium browser and every Electron app. Getting arbitrary code execution from a V8 CVE means the model took a known vulnerability description and built something that runs attacker-chosen instructions inside the renderer. Anthropic states that 21 of 41 such CVEs fell to Mythos Preview across the combined Baseline and Nudged variants. Zero for everything else tested.
Then there is the sandbox. Anthropic’s own wording on the ExploitBench page: “Escaping the V8 sandbox, going from T3 to T2, is the next capability cliff; Mythos Preview is the only tested model that can reliably do so, which it does in over half the tested environments.” A renderer compromise that stays in the sandbox is bad. One that leaves the sandbox is a different class of problem, because that is the boundary between the tab being owned and the machine being owned.
The 226 figure is worth pausing on separately. In a two-hour window, Mythos Preview achieved unauthorized code execution via the intended vulnerability on 157 tasks. Counting paths the task authors did not intend, the total reached 226. That gap of 69 is the interesting part: roughly a third of the successes came through routes the benchmark designers did not anticipate. Anyone who has written a CTF challenge and then watched someone solve it sideways knows the feeling. Scale it to a model running unattended for two hours.
Does a six-exploit lead justify gated access?
Anthropic’s argument for keeping Mythos Preview behind a defensive-security partner program has been consistent and, on its face, reasonable. The October 6, 2026 Glasswing post describes Mythos Preview as an unreleased frontier model available only to selected defensive partners. The October 26 post states that Project Glasswing enabled trusted defenders to find more than 10,000 vulnerabilities in critical software before similarly capable models became broadly available. The structure of that argument: we got a head start, we spent it on defence, and the head start is now ending.
The GLM-5.3 number is Anthropic telling you the head start has ended. 50 of 410 versus 56 of 410, a gap of six successful exploit chains, from a model with open weights.
What the comparison does not coverGLM-5.3’s score is reported on the end-to-end exploit benchmark. I found no figure in the research data for how GLM-5.3 performs on the V8 CVE set or the sandbox escape. Those may be very different numbers. Treat “the gap has closed” as true for end-to-end exploit development and unproven elsewhere.
That caveat matters more than most coverage will give it credit for. The two benchmarks measure different things. End-to-end exploit development at 13.7% success is a general capability. Driving 51.2% of a hard V8 CVE set to arbitrary code execution and escaping the sandbox over half the time is a specialist capability on one of the most heavily hardened targets in commercial software. GLM-5.3 could plausibly be six exploits behind on the general task and nowhere near on V8. Anthropic did not publish that comparison, and I am not going to assume it either way.
8.4% is the number that should worry you, not 51.2%
The figure from the coordinated vulnerability disclosure dashboard, dated October 2, 2026: 6,157 vulnerabilities disclosed across 591 open-source projects, 516 patched. That is a patch rate of roughly 8.4%.
The earlier Glasswing initial update reported 530 high- or critical-severity bugs in open-source software, 75 patched, 65 with public advisories. Both ratios tell the same story from different angles. Discovery is cheap and automated now. Remediation is still maintainers with day jobs and release processes that take weeks.
Anthropic built a machine that finds vulnerabilities faster than the ecosystem can fix them, then published the evidence.
I do not think this makes Glasswing a bad program. Finding 10,000 vulnerabilities and disclosing 6,157 of them is real defensive work, and the alternative (nobody finds them until someone malicious does) is clearly worse. But the defensive case for gated access rests on an implicit assumption: that a vulnerability found by a defender is a vulnerability neutralised. At an 8.4% patch rate, that assumption does not hold. For roughly 5,600 of those disclosures, what currently exists is a public or semi-public record that a bug is there, and no fix.
My take: the disclosure backlog is a bigger operational risk right now than GLM-5.3’s capability. An unpatched, disclosed vulnerability in an open-source dependency is a target with an address on it. The June 2, 2026 expansion of Glasswing to roughly 150 additional organizations widened the discovery funnel without any published evidence that remediation capacity grew to match. **I would want to see patch throughput reported as a first-class metric before I read the next discovery number as good news.**
What this changes for anyone shipping software this quarter
The practical effect of these two publications, taken together, is that the threat model you can defend in a board meeting has changed. Until October 26, you could argue that frontier-grade exploit development was concentrated in a handful of labs with access controls. After October 26, Anthropic’s own data says an open-weight model is within six exploits of their gated frontier model on a 410-attempt benchmark. Open weights do not have access controls.
A few things follow, and none of them are exotic.
If your product embeds Chromium or Electron, the V8 result is directly about you. 21 of 41 CVEs reaching arbitrary code execution, with sandbox escape in over half of environments, describes a capability that already exists in at least one model and is probably reproducible. Patch cadence for the embedded runtime is a security control now, not a maintenance chore.
Your dependency audit needs to account for the disclosure backlog. If you consume packages from the 591 open-source projects covered by that dashboard, there is a reasonable chance you are running something that has been disclosed and not patched. Working out which of your dependencies sit in that 91.6% is concrete and finishable.
Then there is the part where most organisations are not at the starting line. CYGNVS’s resilience briefing, updated October 25, 2026, reports that nearly nine in ten organizations experienced an AI incident and 80% run generative AI, while only one in three test their models against attacks. Two thirds of companies running generative AI have no adversarial testing at all. The capability curve in the ExploitBench data is running against an operational baseline where most defenders have not started measuring.
This is a pattern, not an eventI wrote in August about Anthropic’s review of 141,006 test runs finding three production system breaches, and in September about a threat report that shipped zero indicators of compromise. The consistent shape across all three: Anthropic publishes genuinely useful capability data and consistently publishes less of the operational detail defenders would need to act on it.
There is no public model card for Claude Mythos Preview that I can point you to. A source review of Anthropic.com in October 2026 found none; the ExploitBench research page is the principal official technical description of the model’s offensive capability. Keysight summarised the results independently on October 27, which confirms the figures are circulating, not that anyone outside Anthropic has verified the methodology.
That is an honest limitation on everything above. One organisation ran the benchmark, defined the benchmark, built one of the models being benchmarked, and published the results. I take the numbers seriously because Anthropic published the one that hurts their own position. It is a weak form of evidence, and I would rather have a reproducible harness.
What I expect over the next two quarters
I expect the gated-access justification to be quietly retired. Once an open-weight model is within six exploits of your frontier model on your own benchmark, “we gate this to protect defenders” stops being a policy and starts being a product decision. My prediction: Mythos Preview or its successor reaches general availability with usage policies rather than access gates within six months, and the framing shifts from capability control to abuse monitoring.
I expect the patch rate to become the contested number. 8.4% is uncomfortable enough that someone will either improve it or stop reporting the denominator. The more interesting version is if Anthropic starts publishing automated patch generation results, which the June 2 expansion already gestured at: partners were described as using Mythos Preview for vulnerability discovery and patch development. If a model that finds 10,000 bugs can also propose fixes for them, the 8.4% number is solvable rather than structural.
Flagging this next one as speculation, because it is. I suspect the V8 sandbox escape is the capability that shows up in the wild first, because browser engines are the highest-value shared attack surface on the internet and the research is now public enough to replicate the approach even without the model.
What I would not do is treat the 51.2% as the headline. **The headline is that Anthropic measured a six-exploit lead and told everyone.** Everything downstream of that (your dependency posture, your patch cadence, whether you adversarially test the models you ship) was already overdue on October 25 and is now simply dated. If you want to work out what your actual exposure looks like rather than what the number means in the abstract, that is the kind of thing I am happy to talk through, and one conversation usually settles whether you have a real problem or a reporting one.
