The Engineer

This is not another benchmark story. Claude Mythos Preview hit 93.9% on SWE-bench Verified — a 13-point jump from Opus 4.6's 80.8% in February — and the same general reasoning improvements that resolve complex multi-file GitHub issues have accidentally created the most potent vulnerability discovery engine ever built.

What Mythos Actually Found

Without any specialized cybersecurity training, Mythos discovered: Linux kernel RCEs enabling complete machine takeover, a 27-year-old OpenBSD vulnerability in a codebase legendary for security rigor, a flaw in FFmpeg that survived 5 million automated fuzzing runs, and vulnerabilities in every major browser and OS. The critical technical detail: Mythos isn't pattern-matching known CVEs. It finds 5 separate vulnerabilities in a single codebase and composes them into novel exploit chains — the difference between 'medium-severity buffer overread' and 'chain of five issues that gives you root.'

Your existing SAST/DAST/fuzzing tools find individual issues. Mythos finds chains. Defense-in-depth assumes independent failure modes across layers; AI-driven chaining systematically violates that assumption.

The 6-Month Window

Alex Stamos estimates open-weight models reach parity in approximately 6 months. After that, every ransomware operator can run local models to discover zero-days with no network forensic trail. This isn't a lab curiosity — these capabilities emerged from general reasoning improvements, meaning every frontier lab pursuing reasoning will cross this threshold. Anthropic got there first and decided to ring the alarm.

Project Glasswing: The Coordinated Patch Sprint

40+ companies including Apple, Google, Microsoft, Cisco, and Broadcom, backed by $100M in Anthropic compute credits, are racing to patch critical open-source infrastructure before the window closes. The scope explicitly includes C/C++ libraries, media codecs, and crypto libs.

The Uncomfortable Meta-Question

A single private company now possesses zero-day exploits for almost every major piece of software. Anthropic's model weights themselves become an extraordinarily high-value target. The irony of the US government simultaneously trying to designate Anthropic as a supply chain risk while needing them for national cyber defense is not lost. Your defensive posture now partially depends on the security of Anthropic's infrastructure.

What This Means For Your Stack

The 6-month window is a hard deadline for defensive patching, not a soft target. If your production stack depends on OSS projects that aren't in a Glasswing partner's scanning scope, those vulnerabilities may not be found defensively in time. Your existing vulnerability scanning tools were designed to find known patterns, not reason about vulnerability chains.

Trivy Compromised the EU Commission

Aqua Security's Trivy — the most popular open-source container/IaC scanner — was supply-chain compromised on March 19. The compromised version stole AWS API keys, enabling attackers to exfiltrate 340 GB of data from the European Commission, including email content from 42 internal EC clients and 29+ EU entities. The attacker obtained management rights for the compromised AWS secret, enabling lateral movement. Trivy is probably in your CI/CD pipeline right now, likely with access to IAM roles, environment variables, and ECR tokens.

The tool you trust to find vulnerabilities became the vulnerability. Your security scanner had more access to your crown jewels than most production services.

GrafanaGhost: AI-Mediated Exfiltration Your SIEM Can't See

Noma Security demonstrated a chainable prompt-injection exploit that exfiltrates data from Grafana instances without credentials or user interaction. The attack slips hidden instructions past domain validation and AI guardrails simultaneously, coercing the AI into making outbound requests where the URL itself encodes stolen data. From a network traffic perspective, this looks like normal AI behavior — your SIEM and DLP are architecturally incapable of detecting it. Grafana patched, but the pattern applies to any internal tool with AI features that can take external input and has outbound network access.

React2Shell: 760+ Next.js Apps Already Compromised

CVE-2025-55182 is a pre-authentication RCE in React Server Components — the default in Next.js App Router since v13. Threat cluster UAT-10608 has automated exploitation, compromising 760+ systems and exfiltrating 10,000+ files in large-scale credential harvesting. 'Pre-auth' means no session, no token, no user-state WAF rule protects you.

The Pattern: Every Trust Boundary Is Being Tested Simultaneously

This isn't isolated incidents — it's a convergence of supply-chain attack vectors:

• Trivy: Security scanner as credential harvester (March 19 supply chain)
• Strapi npm: 36 typosquatting packages with 8-stage payloads exploiting postinstall hooks
• GrafanaGhost: AI-augmented internal tooling as exfil channel
• FortiClient EMS: Second CVSS 9.8 in weeks — systemic code quality, not isolated bugs
• Keycloak: CVE-2026-3429 bypasses MFA entirely
• BYOVD: Qilin/Warlock disabling 300+ EDR tools at kernel level

The common thread: the infrastructure you trust for security is the attack surface. Your scanner, your dashboards, your endpoint manager, your identity provider, and your EDR are all simultaneously compromised or compromisable.

The Headline vs. The Substance

OpenAI's Frontier team shipped an internal Electron app: 1M lines of code, 0% human-written, 0% pre-merge review, ~1,500 PRs, 1B tokens/day. The shocking headline obscures the real engineering substance: the brutal infrastructure requirements they discovered along the way.

Build Time Is Now Agent Infrastructure

When GPT-5.3 gained background shells, the model became impatient with long builds — literally thrashing instead of waiting. The team migrated from Makefile→Bazel→Turbo→NX in a single week to hit a sub-60-second build ceiling. This isn't optimization — it's a hard constraint. At hundreds of concurrent agent sessions, every second of build time compounds across thousands of parallel runs. If your build takes 12 minutes, your agents are running at a fraction of potential throughput.

The Model Chose Elixir

Symphony, their orchestration layer, runs on Elixir/BEAM — chosen by the model, not humans — because OTP supervision trees map naturally to agent lifecycle management. The 'rework' pattern is pure Erlang: when a PR fails review, Symphony trashes the worktree entirely and restarts from scratch. This works because agent compute is cheap relative to debugging partially-failed state. If you're building incremental retry logic for agent failures, you're probably over-engineering it.

MCP: Simultaneous Adoption and Rejection

Here's a genuine contradiction across sources. Google Ads and Figma just shipped MCP integrations, Gemma 4 has native MCP support, and MCP is being adopted as the de facto agent-to-service interface. But Ryan — OpenAI's most extreme Codex power user, consuming more agent tokens than almost anyone — calls MCP broken: forced token injection interferes with auto-compaction, causing agents to forget how to use tools. The Spark model 'blew through three compactions before writing a line of code.' His winning pattern: Unix-philosophy CLI tools with structured, token-efficient output.

MCP is becoming the REST of agent integration — ubiquitous but potentially wrong for high-throughput agent workflows. Adopt it as a standard interface for service exposure, but test thoroughly in tight agent loops.

The Quality Crisis Nobody's Measuring

Controlled experiments now show AI coding assistants produce 41% more bugs despite a 26% speed gain. A Chroma study quantifies the context trap: LLM accuracy degrades from 95% to 60% as context window input grows. Beck and Fowler's Pragmatic Summit adds another dimension: AI coding tools degrade substantially on large, complex codebases vs. greenfield — precisely where enterprises need help most.

Beck's sharpest tactical insight: two humans paired with AI agents outperform one human with many agents. AI latency is a feature — 3-minute waits create space for human discussion about naming, design, and architecture. As AI gets faster, we paradoxically lose collaborative design time.

The Numbers Are Staggering

GitHub went from 1 billion commits in all of 2025 to a 14 billion annual run rate in Q1 2026. That's 275 million commits per week. Agent-generated PRs jumped from 4M to 17M in six months. Claude Code alone went from 100K to 2.5M weekly commits — a 25x increase. This isn't growth; it's a phase transition from human-centric collaboration platform to agent-centric code firehose.

Why GitHub's Infrastructure Can't Cope

GitHub COO Kyle Daigle acknowledged rising outages, with availability dropping to approximately 90%. Databases and Redis clusters are saturating because AI agents don't browse — they hammer APIs in tight loops, submit PRs in batches, and trigger webhooks at machine speed. Rate limit schemes designed for human cadence (5,000 requests/hour for authenticated users) break completely under 24/7 autonomous processes. The Redis cluster saturation specifically suggests AI agent traffic is thrashing LRU caches — agents issue more diverse, less temporally correlated requests than humans.

GitHub's caching layer was sized and keyed for human browsing patterns. AI agents systematically defeat cache efficiency. This is a preview of what happens to every developer platform as agent traffic scales.

Compounding Risk: Concurrent Azure Migration

GitHub is simultaneously migrating from its own data centers to Azure. Any engineer who's done a large-scale cloud migration knows this is already a multi-quarter reliability risk. Compound it with 14x traffic growth from fundamentally different access patterns, and you have a recipe for an extended reliability degradation period. Expect GitHub to rearchitect rate limiting aggressively — any integration relying on current limits should be treated as fragile.

The Competitive Fracture

OpenAI is reportedly considering building its own GitHub alternative. GitHub's former CEO just launched a competing 'AI-friendly' code platform. These signals suggest the code hosting near-monopoly may fragment. This doesn't mean migrate away tomorrow, but treating GitHub as an assumed constant rather than a dependency with a risk profile is increasingly naïve.

What Meta's 60T Tokens Tells You

Meta's internal 'Claudeonomics' leaderboard has 85,000 employees burning 60 trillion tokens per month, top user at 281 billion tokens — with engineers running agents continuously just to climb the leaderboard. Internal pushback says 'token usage is NOT impact.' This is the lines-of-code metric reborn at industrial scale, and it's one of the forces driving GitHub's infrastructure crisis.