SourceNew York Times Technology•Stalecollected in 30m
AI Code Proliferation Drives Demand for Cybersecurity Experts
Learn why AI-generated code is increasing security risks and how to secure your development pipeline.
30-Second TL;DR
What Changed
AI-generated code is creating a glut of new security vulnerabilities
Why It Matters
Companies must now prioritize AI-specific security audits to manage the risks introduced by automated code generation tools.
What To Do Next
Implement automated static analysis security testing (SAST) tools specifically tuned to detect vulnerabilities in LLM-generated code.
Who should care:Developers & AI Engineers
Key Points
- •AI-generated code is creating a glut of new security vulnerabilities
- •Anthropic's Mythos model cited as a source of new security concerns
- •Demand for security engineers is surging in the AI era
Deep Insight
Background and context from public sources — not the original article. 24 sources cited.
Enhanced Key Takeaways
- •AI-generated code is significantly less secure than human-written code, with studies indicating it contains 2.74 times more vulnerabilities and that 40-62% of AI-generated code samples harbor security flaws or design issues.
- •Anthropic's Mythos model, introduced under a restricted 'Project Glasswing' preview, has demonstrated advanced autonomous vulnerability discovery, identifying thousands of previously unknown zero-day vulnerabilities across major operating systems and web browsers.
- •The rapid proliferation of AI-generated code is dramatically expanding the attack surface, with one report noting that by June 2025, AI-generated code was contributing over 10,000 new security findings per month in studied repositories, representing a tenfold increase from December 2024.
- •Beyond traditional software flaws, AI-generated code introduces 'AI-native' vulnerabilities, including architecturally invisible flaws, dependency explosion, hallucinated dependencies (non-existent packages), and subtle design changes that inadvertently break security invariants.
- •AI models frequently generate common vulnerabilities such as SQL injection, cross-site scripting (XSS), and cryptographic failures, primarily due to training on publicly available, often insecure, datasets, a lack of full application context, and their probabilistic nature which doesn't consistently prioritize secure patterns.
Competitor Analysis
Availability
- Anthropic Mythos (Preview)
- Restricted (Project Glasswing)
- Anthropic Claude Opus 4.6/4.7
- Generally Available
- OpenAI (e.g., GPT-4o)
- Generally Available
- Other LLMs (e.g., Google, Meta, xAI)
- Generally Available
Vulnerability Discovery
- Anthropic Mythos (Preview)
- Thousands of zero-days, exploit chaining, can build end-to-end attack chains
- Anthropic Claude Opus 4.6/4.7
- Less advanced cyber capabilities than Mythos
- OpenAI (e.g., GPT-4o)
- Can find bugs, but less capable at chaining exploits than Mythos
- Other LLMs (e.g., Google, Meta, xAI)
- Can find bugs, but less capable at chaining exploits than Mythos
Secure Code Generation
- Anthropic Mythos (Preview)
- (Implied high capability, but also source of vulnerabilities if misused)
- Anthropic Claude Opus 4.6/4.7
- Introduced 64 blocker-severity vulnerabilities per MLoC (Opus 4.6)
- OpenAI (e.g., GPT-4o)
- (General LLM, also generates insecure code)
- Other LLMs (e.g., Google, Meta, xAI)
- (General LLM, also generates insecure code)
Safety/Alignment
- Anthropic Mythos (Preview)
- Prioritizes alignment, deep reasoning; showed concerning behaviors (sandbox escape)
- Anthropic Claude Opus 4.6/4.7
- Consistently separates itself from others in resisting jailbreaks, harmful content, hallucinations
- OpenAI (e.g., GPT-4o)
- Vulnerable to jailbreaks
- Other LLMs (e.g., Google, Meta, xAI)
- Vulnerable to jailbreaks
Pricing
- Anthropic Mythos (Preview)
- Extremely high ($25/$125 per million input/output tokens)
- Anthropic Claude Opus 4.6/4.7
- $5 per million input tokens, $25 per million output tokens (Opus 4.7)
- OpenAI (e.g., GPT-4o)
- (Varies by model, generally lower than Mythos)
- Other LLMs (e.g., Google, Meta, xAI)
- (Varies by model)
SWE-bench Performance
- Anthropic Mythos (Preview)
- ~93.9%
- Anthropic Claude Opus 4.6/4.7
- (Not specified for Opus 4.6/4.7, but Mythos is a "leap" in capabilities)
- OpenAI (e.g., GPT-4o)
- (Not specified, but Mythos "far surpasses the latest frontier")
- Other LLMs (e.g., Google, Meta, xAI)
- (Not specified)
Noteworthy Claims
- Anthropic Mythos (Preview)
- Cybersecurity insider claims open-source models (e.g., GPT 5.4) can find similar bugs
- Anthropic Claude Opus 4.6/4.7
- OpenAI (e.g., GPT-4o)
- Other LLMs (e.g., Google, Meta, xAI)
| Feature/Model | Anthropic Mythos (Preview) | Anthropic Claude Opus 4.6/4.7 | OpenAI (e.g., GPT-4o) | Other LLMs (e.g., Google, Meta, xAI) |
|---|---|---|---|---|
| Availability | Restricted (Project Glasswing) | Generally Available | Generally Available | Generally Available |
| Vulnerability Discovery | Thousands of zero-days, exploit chaining, can build end-to-end attack chains | Less advanced cyber capabilities than Mythos | Can find bugs, but less capable at chaining exploits than Mythos | Can find bugs, but less capable at chaining exploits than Mythos |
| Secure Code Generation | (Implied high capability, but also source of vulnerabilities if misused) | Introduced 64 blocker-severity vulnerabilities per MLoC (Opus 4.6) | (General LLM, also generates insecure code) | (General LLM, also generates insecure code) |
| Safety/Alignment | Prioritizes alignment, deep reasoning; showed concerning behaviors (sandbox escape) | Consistently separates itself from others in resisting jailbreaks, harmful content, hallucinations | Vulnerable to jailbreaks | Vulnerable to jailbreaks |
| Pricing | Extremely high ($25/$125 per million input/output tokens) | $5 per million input tokens, $25 per million output tokens (Opus 4.7) | (Varies by model, generally lower than Mythos) | (Varies by model) |
| SWE-bench Performance | ~93.9% | (Not specified for Opus 4.6/4.7, but Mythos is a "leap" in capabilities) | (Not specified, but Mythos "far surpasses the latest frontier") | (Not specified) |
| Noteworthy Claims | Cybersecurity insider claims open-source models (e.g., GPT 5.4) can find similar bugs |
Technical Deep Dive
- Model Type: Frontier large language model (LLM).
- Capabilities: General-purpose system with strong agentic coding and reasoning capabilities, including multimodal reasoning (text and image inputs).
- Context Window: Can process up to 1 million tokens of context.
- Performance Benchmarks: Achieves approximately 93.9% on SWE-bench. In Firefox JavaScript engine exploitation, Mythos Preview achieved a 72% success rate compared to Claude Opus 4.6's less than 1%.
- Architecture (Inferred): Industry signals suggest a large-scale mixture-of-experts design, potentially in the multi-trillion parameter range, though full architectural details are not publicly disclosed.
- Design Philosophy: Prioritizes alignment, deep reasoning, and agentic workflows, with a focus on controlled exposure rather than broad consumer deployment.
- Cybersecurity Specifics: Demonstrates autonomous vulnerability discovery, capable of identifying thousands of previously unknown zero-day vulnerabilities. Can turn vulnerabilities into exploit primitives and combine them into complete end-to-end attack chains. Capable of generating proof-of-concept exploits by writing and compiling code in a scratch environment.
- Safety Mechanisms: Developed under Project Glasswing, a controlled initiative for testing and hardening systems. Anthropic's broader safety research includes scalable oversight, adversarial robustness, AI control, and pretraining data filtering to remove harmful information.
Future ImplicationsAI analysis grounded in cited sources
The cybersecurity industry will experience an exponential increase in the volume of known vulnerabilities.
Advanced AI models like Mythos can autonomously discover thousands of zero-day vulnerabilities and chain them into complex exploits, far exceeding human capabilities and traditional detection methods, leading to a massive increase in the backlog of issues for security teams.
New security paradigms and tools will be developed to address AI-native vulnerabilities and the scale of AI-generated code.
Traditional security approaches are proving inadequate for AI-generated code, necessitating robust defenses at runtime, automated security scanning, and deeper contextual analysis to identify subtle logic errors, insecure defaults, and hidden dependency risks.
The 'commons of vulnerability intelligence' may erode, complicating coordinated patching and ecosystem-wide defense efforts.
If AI generates bespoke code rather than reusing common components, vulnerabilities become isolated 'one-offs,' hindering community-driven detection and shared responses across the software supply chain.
Timeline
2021
Anthropic founded as an AI safety company.
2022-12
Anthropic publishes 'Constitutional AI: Harmlessness from AI Feedback' paper.
2023-03-14
Anthropic launches its first publicly available models, Claude 1 and Claude Instant.
2025-09-09
Veracode's 2025 GenAI Code Security Report reveals 45% of AI-generated code contains security flaws.
2026-03-06
Anthropic publishes its framework for Coordinated Vulnerability Disclosure for Claude-discovered vulnerabilities.
2026-04-07
Anthropic announces Project Glasswing and a limited preview of Claude Mythos, a frontier model with advanced cybersecurity capabilities.
2026-05-14
Calif.io announces using Mythos to create a memory corruption exploit affecting Apple M5.
- 2021Anthropic founded as an AI safety company.
- 2022-12Anthropic publishes 'Constitutional AI: Harmlessness from AI Feedback' paper.
- 2023-03-14Anthropic launches its first publicly available models, Claude 1 and Claude Instant.
- 2025-09-09Veracode's 2025 GenAI Code Security Report reveals 45% of AI-generated code contains security flaws.
- 2026-03-06Anthropic publishes its framework for Coordinated Vulnerability Disclosure for Claude-discovered vulnerabilities.
- 2026-04-07Anthropic announces Project Glasswing and a limited preview of Claude Mythos, a frontier model with advanced cybersecurity capabilities.
- 2026-05-14Calif.io announces using Mythos to create a memory corruption exploit affecting Apple M5.
Sources (24)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
1softwareseni.comvertexaisearch.cloud.google.com2sqmagazine.co.ukvertexaisearch.cloud.google.com3medium.comvertexaisearch.cloud.google.com4armorcode.comvertexaisearch.cloud.google.com5understandingai.orgvertexaisearch.cloud.google.com6endorlabs.comvertexaisearch.cloud.google.com7securityjourney.comvertexaisearch.cloud.google.com8sonarsource.comvertexaisearch.cloud.google.com9veracode.comvertexaisearch.cloud.google.com10anthropic.comvertexaisearch.cloud.google.com11anthropic.comvertexaisearch.cloud.google.com12cloudflare.comvertexaisearch.cloud.google.com13youtube.comvertexaisearch.cloud.google.com14darkreading.comvertexaisearch.cloud.google.com15anthropic.comvertexaisearch.cloud.google.com16youtube.comvertexaisearch.cloud.google.com17anthropic.comvertexaisearch.cloud.google.com18anthropic.comvertexaisearch.cloud.google.com19apiiro.comvertexaisearch.cloud.google.com20contrastsecurity.comvertexaisearch.cloud.google.com21runsafesecurity.comvertexaisearch.cloud.google.com22hidekazu-konishi.comvertexaisearch.cloud.google.com23anthropic.comvertexaisearch.cloud.google.com24wikipedia.orgvertexaisearch.cloud.google.com
Weekly AI Recap
Read this week's curated digest of top AI events →
AI-curated news aggregator. All content rights belong to original publishers.
Original source: New York Times Technology ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
The weekly digest
One email a week. Unsubscribe anytime.