In April, Anthropic introduced Claude Mythos Preview. Around the same time, the number of publicly disclosed vulnerabilities began to rise sharply &mdash; in July, it was approximately five times higher than the previous record.

A vulnerability is a weakness in software that, under certain conditions, can, for example, allow someone to access other people&#39;s data or disrupt a service.

In Anthropic&#39;s tests, the model demonstrated that it could help identify such flaws &mdash; analyzing code, checking suspicious areas, and determining whether they could actually be exploited by attackers. In some cases, the model found vulnerabilities in long-existing code that may have gone unnoticed for decades.

The number of vulnerabilities found has increased, but that does not necessarily mean that software has suddenly become less secure or that the number of attacks has increased.

Imagine a building being inspected for the first time with a more precise instrument: the number of detected defects increases, even though some of them have existed for a long time. The situation here is similar.

As Epoch AI notes, the statistics are affected both by the ability to find vulnerabilities and by researchers&#39; attention, while assessments of the severity of vulnerabilities can also be revised. A single chart cannot tell us what share of the increase was driven specifically by AI.

<img alt="monthly high- and critical-severity CVEs" src="https://s3.timeweb.com/doubletapp-dt-site-prod/files/uploads/2026/09/21/3-3.png" style="height:auto; width:100%" />

Data source:&nbsp;<a href="https://www.a16z.news/p/chart-of-the-week-experience-skills" style="text-decoration:none" target="_blank">Charts of the Week</a>,&nbsp;<a href="https://epoch.ai/data-insights/cve-severity-spike-july-2026" target="_blank">Epoch AI</a>

But the takeaway for businesses is already quite practical. AI is accelerating not only the discovery of vulnerabilities, but also the development of ways to exploit them. This makes it important to understand what components your services are built from, who monitors reports of critical vulnerabilities, and how quickly your team can assess and deploy fixes.

Context

The September issue of the Charts of the Week review, published on the a16z media platform, features a concerning chart: it shows the number of publicly disclosed high- and critical-severity vulnerabilities reported across 21 major technology organizations and projects, including Apple, Microsoft, Google, AWS, Cisco, Linux, Oracle, and others. The number began to rise sharply in spring 2026, reaching approximately 2,500 vulnerabilities in July.

AI HELPS FIND VULNERABILITIES: WHAT DOES THIS MEAN FOR BUSINESSES?

Share on social networks

Let's work together!