Anthropic's 100-day Mythos report in Mythos report in —
Urgent · Seal Security Research · April 2026

The vulnerability disclosure process is not ready for the age of AI.

If your dependency scanner waits for CVE advisories, it's already weeks late, and agents have closed that gap for the attacker. Since the start of 2026, we've been monitoring public commits across 100k+ JavaScript repositories and feeding security-patching commits to a blind Sonnet 4.6 agent with nothing but the diff. For 97 security fixes, within minutes, a working exploit POC fell out: no CVE id, no advisory text, no human in the loop. Turning a public fix commit into a working exploit used to cost skilled humans hours to days per bug, even in the easy cases. Not anymore.

Commit-first rate
94%
of CVEs have a public fix commit before the advisory
Median patch gap
11days
between first push of the fix and the advisory
Exploits demonstrated
97
advisories exploited from the diff alone
Surgically patchable
99%
of security fixes can be applied without breaking code changes using Seal
Get ahead of the advisory
By package ecosystem

npm fixes ship in a week. Maven takes months.

Per-ecosystem medians vary by 80x. Even in npm, the fastest ecosystem, an attacker has a full week with the diff before the advisory drops.

Median patch gap by ecosystem

Days between fix commit and advisory · log scale

The systemic risk

The disclosure process leaks its own exploits.

Coordinated disclosure assumes the fix commit is a harmless implementation detail and the advisory is the signal attackers follow. That assumption held when reading a diff and turning it into a working exploit took a skilled human hours to days per bug in high-level programming languages, plus the unquantifiable cost of sifting through thousands of commits to find a vulnerability in a call path worth weaponizing. It does not hold any more.

!

Critical bugs get the most exposure

Critical-severity CVEs sit at a 30-day median gap, twice as long as high severity (15 days). Whether the cause is embargo, backports, or retroactive CVE assignment, attackers get a full month with the most dangerous bugs before most scanners flag them.

11d

Your scanner waits for the advisory

If your SCA tool relies on NVD, GitHub Advisory, or OSV feeds, it alerts you when the advisory publishes. Overall, the fix commit for that CVE was pushed to GitHub 11 days earlier. The advisory isn't needed to identify, understand, or patch the vulnerability. The commit is sufficient.

97

An agent closes the gap for the attacker

For 97 security fixes, within minutes, a working exploit POC fell out: no CVE id, no advisory text, no human in the loop. The fix commit itself is now a reliable exploit primitive.

The experiment · running since January 2026

Is the gap actually exploitable?

Since the start of 2026, we've been monitoring public commits across 100k+ JavaScript repositories and feeding security-patching commits to a blind Sonnet 4.6 agent armed only with a bash tool and the parent-to-fix diff. No CVE id, no advisory text, nothing a human analyst would normally read first.

Step 1 · Scan
100k+
JavaScript repositories monitored continuously for security-relevant commits.
Step 2 · Triage
98.2%
of critical security fixes flagged by a blind classifier reading nothing but the diff. It also flags hundreds of false positives, but that just means 10x the cost of the exploit POC step.
Step 3 · Exploit POC
97
working exploit POCs generated from the diff alone. Minutes per bug, no human in the loop.
Announcing

Seal Security launches the Mythos Readiness Program.

Advisory-dependent scanning
Your SCA tool alerts on CVE-2026-XXXX when the advisory publishes. Attackers have 11 days to weaponize.
vs
Seal Security
Seal patches your dependencies when the fix commit is pushed. Day one.
You have — days until Anthropic's 100-day Mythos report to act

For companies that aren't part of Anthropic's private Mythos review, Seal is providing implementation support alongside full access to the Seal platform — for the 50 companies that join the Mythos Readiness Program. Apply security fixes weeks earlier than the advisory. No upgrade required. No supply-chain risk. No vendor lock.