Mythos vulnerabilities: is your third-party patching keeping up?

TL;DR: Anthropic’s Mythos tooling surfaced 26,153 candidate vulnerabilities, with 4,576 confirmed, about 2,300 disclosed, and only 421 patched, according to Black Kite, showing that discovery now outpaces remediation in third-party software. The practical risk is not flaw discovery itself, but vendor queue backlog, concentration risk, and the inability to govern what you cannot patch.

Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “2,300 Mythos Vulnerabilities Disclosed. 421 Patched. That Gap Is in Your Supply Chain.”.

By the numbers:

• Black Kite says roughly 2,300 vulnerabilities were formally disclosed across 392 open-source projects, but only 421 have been patched.
• Black Kite reports that Anthropic’s dashboard showed a 91.4% true positive rate on external review.

Key questions

Q: What breaks when a third-party vulnerability is disclosed faster than suppliers can patch it?

A: The control that breaks is remediation-led governance.

Q: Why does slow third-party patching increase supply chain risk?

A: Because disclosure turns a hidden flaw into a known weakness while leaving the fix outside your control.

Q: What are the signs that third-party vulnerability governance is failing?

A: The main signals are long vendor response times, repeated exposure in shared components, and a growing gap between confirmed findings and actual patches.

Practitioner guidance

• Build a remediation-first vendor scoring model Rank suppliers by patch latency, confirmed disclosure handling, and the number of load-bearing dependencies they operate in your environment.
• Map shared software dependencies across third parties Identify libraries, services, and integrations that appear in multiple vendors so one flaw does not become a multi-vendor exposure event.
• Separate discovery volume from actionable exposure Create a triage process that filters candidate findings by exploitability, business path, and whether the affected vendor can realistically patch.

Bottom line: AI-assisted vulnerability discovery has shifted the bottleneck from finding flaws to getting third parties to fix them.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →