Security
Anthropic's AI finds Microsoft bugs faster than engineers can patch them
A powerful new AI model from Anthropic is uncovering critical vulnerabilities in Microsoft software at a pace that outstrips the company's ability to fix them.
Ars Technica
Microsoft convened an urgent gathering of engineers and managers at its Redmond headquarters in mid-May to address a mounting crisis: the company's defenses against software vulnerabilities were being outpaced by an AI system designed to find them.
The AI in question, Claude Mythos Preview, was developed by Anthropic and given to select major software makers as part of an effort to identify and remedy security gaps before malicious actors could weaponize the same technology for espionage or sabotage. Yet the tool was surfacing weaknesses in Microsoft's systems—particularly SharePoint, the company's widely deployed collaboration platform—far faster than teams could deploy fixes.
The scale of the problem#
During April alone, Mythos uncovered 90 critical bugs and 141 important ones in SharePoint. The rate only accelerated into May. As one manager told the assembled group, Microsoft was now caught in "a mad dash" to close the widening gap between detection and remediation.
Engineering leadership stressed the urgency of the moment. With an internal deadline of May 31, managers pleaded with teams to prioritize patching vulnerabilities discovered early in the month. "Please, please, please if your org has any April bugs, drive those down," one manager implored, warning that time was running out to act before external threats gained access to the same capability.
A race against the clock#
The meeting laid bare an uncomfortable reality: the window for Microsoft to fix these flaws before hostile actors—whether criminal groups or state-sponsored teams from countries like China—obtained comparable AI tools was closing rapidly. Once June 1 arrived, the logic went, adversaries would have caught up technologically and could begin exploiting the same vulnerabilities themselves.
One engineer distilled the existential stakes plainly during the call: "So basically you're saying if it's released on June 1, then on June 2 the adversaries will have our bugs?"
The exchange underscored how AI-powered vulnerability discovery has fundamentally shifted the game of software security, compressing the traditional timeline from months or years to weeks.
