A new Anthropic study finds its most capable model built working exploits for Firefox and Windows vulnerabilities faster than automatic updates could reach most devices.
Anthropic’s security research team has published a study measuring how quickly large language models (LLMs) can reverse-engineer working exploits from software security patches — and the results challenge core assumptions behind modern patch management strategies. [1]
When a software vendor releases a security fix, attackers can compare the old and new code to pinpoint the underlying vulnerability, a technique that historically took weeks of specialized work. [1] According to Verizon breach data cited in the Anthropic report, these so-called N-Day vulnerabilities — where “N” counts the days between patch release and active exploitation — account for a large share of real-world security incidents. [1]
The study tested six Claude models, including an unreleased model called Mythos Preview, against two sets of targets: 18 patches for SpiderMonkey, the JavaScript engine inside Firefox, and 21 Windows kernel vulnerabilities from Microsoft’s January and February 2026 Patch Tuesday releases. [1]
On the Firefox tests, Mythos Preview successfully crashed 14 of the 18 patched vulnerabilities, with the first result arriving after 12 minutes and 13 more within 40 minutes. [1] More critically, the model produced eight working code-execution exploits in roughly 12 hours, with the first completed exploit ready within one hour of the patch going live — 18 days before the patched Firefox 148 was publicly shipped. [1] Anthropic chose Firefox deliberately because its automatic update system and recently accelerated patch cadence represent a best-case scenario for defenders; other software ecosystems offer attackers even more time. [1]
The Windows kernel tests were harder because Microsoft does not publish source code. [1] Mythos Preview had to work from compiled binaries, public debug symbols, a machine-generated decompilation from the Ghidra reverse-engineering tool, a diff of changed functions, and Microsoft’s public security advisory. [1] The model identified 18 of the 21 vulnerabilities in under six hours at a cost of approximately $2,200 in API credits. [1] It was the only model to achieve full privilege escalation — moving from a restricted user account to SYSTEM-level access — building eight complete attack chains at a total cost of about $15,700, or roughly $2,000 per exploit. [1]
The timing is particularly significant for Windows users. Even with Microsoft’s automated Windows Autopatch service, it takes seven days for 90 percent of enrolled devices to receive a patch and eleven days for a forced reboot. [1] All eight of Mythos Preview’s attack chains were completed before a single device would have automatically applied the fix. [1]
The study also found that Microsoft’s own exploitability ratings underestimate AI-assisted risk. [1] Microsoft had classified 14 of the 21 Windows vulnerabilities as “less likely to be exploited” or “unlikely to be exploited” — ratings calibrated to human researchers. [1] Mythos Preview cracked 13 of those 14 and achieved full privilege escalation on one rated “unlikely to be exploited.” [1] Anthropic states that once Mythos-class models become more widely available, Microsoft’s rating methodology will need to be recalibrated. [1]
The researchers note that publicly available Claude models can also develop exploits when safety filters are disabled, just with lower success rates, and that models from other vendors and open-source models likely carry similar capabilities. [1] The researchers write that “a lone operator can now turn a month’s worth of patches into working exploits in a single afternoon — for a few thousand dollars and with no specialized expertise.” [1]
Anthropic argues that the conventional monthly patch cycle and staged rollout model is built on an assumption — that exploit development takes weeks — that no longer holds. [1] The researchers suggest the industry term “N-Day” should give way to “N-Hour” to reflect the new reality. [1] They acknowledge that a complete attack still requires additional steps such as target discovery, payload delivery, and detection evasion, but note that exploit development itself was previously the most time-consuming stage. [1]
For systems that are difficult or slow to update — including industrial control systems, medical devices, and networked equipment with fixed maintenance windows — the risk is greatest. [1] Anthropic points to structural mitigations such as memory-safe programming languages like Rust and hardware-level protections that eliminate entire vulnerability classes as more durable long-term defenses. [1]
The report was published before the release of Claude Fable 5, described as an Anthropic Mythos variant with stronger safety restrictions. [1] Mythos 5 remains available only to institutions Anthropic has selected. [1]
Sources
This article was drafted with AI from the cited sources and checked against them before publication. Spot an error? Let us know.
