AI Just Started Finding Bugs Humans Never Would Have Caught

TLDR;

For years the scary story about AI and cybersecurity was speed: models that could scan faster than humans and find flaws sooner. That story just got a sequel, and it is a lot more unsettling. Claude Mythos and OpenAI’s Codex Cyber models are not just discovering vulnerabilities anymore. They are stitching several small, individually boring bugs together into a full working exploit, something that used to take a skilled human researcher weeks to pull off by hand.

The result is a pile of real CVEs, some hiding in the Linux kernel for over two decades, plus a genuinely uncomfortable question for every security team: how many of your “low severity, fix later” tickets are actually three steps away from root access?

The Bug Backlog Nobody Was Worried About

Every security team has a version of the same shelf: a queue of low and moderate severity findings that never quite reach the top of the sprint. They look harmless individually. A minor race condition here, a small memory leak there, nothing an attacker could realistically weaponize on its own.

That assumption held up fine when the people doing the chaining were humans, because chaining takes time, context, and a fair amount of trial and error. It does not hold up nearly as well now that models can try thousands of combinations overnight without getting bored or running out of budget.

What Chaining Actually Looks Like in Practice

This is not theoretical. Claude Mythos has already demonstrated the pattern on real systems, and the examples are worth sitting with for a minute.

One case combined a tiny out of bounds write in the kernel’s netfilter code with a separate quirk in how the per-CPU page allocator behaves, and used the two together to flip a permission bit and escalate a setuid binary from read-only to writable. Neither bug alone would have raised much concern. Together they added up to privilege escalation.

Another case linked two separate use-after-free bugs, one in Unix domain socket handling and one in the traffic control scheduler, into a working exploit chain. The Cloud Security Alliance has pointed out that no automated tool currently does this kind of multi-bug chaining on its own, which is exactly why it caught people off guard when an AI model did.

Old Bugs, Freshly Weaponized

Skepticism is healthy here, so it helps to look at what has actually been confirmed rather than what sounds alarming in a headline.

A 17 year old stack buffer overflow in FreeBSD’s NFS and RPCSEC_GSS code, allowing unauthenticated remote root, found by Claude Mythos.
RefluXFS, a race condition in the Linux kernel’s XFS filesystem that had existed since kernel 4.11 back in 2017, affecting roughly 16.4 million systems and leaving no trace in kernel logging.
A 23 year old NFSv4.0 bug, introduced all the way back in 2003, that allows a remote kernel memory read.
A SysV semaphore use-after-free in OpenBSD that survived 27 years of audits, code reviews, and expert eyes.
A cluster of epoll related kernel bugs, where Mythos found one flaw but missed a related sibling bug in the same code region, which a human researcher later caught by hand.

That last example matters as much as the others. It is a useful reminder that these models are powerful pattern matchers, not infallible ones. They can miss things right next to what they find, which means human review still has a job to do.

Why the Old Patch Priority Model Is Starting to Crack

Most vulnerability management programs are built around severity scoring individual bugs. CVSS gives you a number, the number tells you where the ticket lands in the queue, and low scores wait longer. That system assumes an attacker has to discover a chain manually, which used to be a safe assumption because chaining required real expertise and real time.

Take that constraint away and the math changes. A handful of “low severity” bugs sitting in the same code path can now be combined by a model into something that reaches root, and it can happen in hours instead of months. Anthropic’s own disclosure said Mythos surfaced thousands of high severity zero-days across major operating systems and browsers in a single evaluation window, and at the time of reporting, over 99 percent of them were still unpatched. Not because they were subtle. Because the volume outran the disclosure and patching pipeline that exists today.

So What Should Teams Actually Do About This

The honest answer is not “buy a new tool,” because chaining is a triage problem before it is a tooling problem. A few practical shifts matter more right now.

Stop treating severity scores as the only signal. Ask whether a “low” bug sits in the same code path, subsystem, or trust boundary as other open findings, because that is where chains form.
Run your own AI assisted scans against your stack the way Qualys did with Mythos on the XFS filesystem, instead of waiting for a disclosure embargo to end.
Re-examine anything that has been open for a long time without being fixed. Age is not evidence of safety. Several of the bugs above sat untouched for over a decade simply because nobody looked hard enough, not because they were hard to find once someone did.
Keep a human in the loop on triage. The epoll case shows models can find one bug and miss its neighbor, so pattern matching from a person still catches things automation does not.
Assume your patch cadence needs to tighten, not because every finding is now critical, but because the backlog itself has become a bigger attack surface than it used to be.

Final Thought

The interesting part of this story is not that AI can find bugs quickly. Everyone already expected that. The interesting part is that it can now do the slow, patient, creative work of connecting unrelated flaws into something dangerous, which used to be the part that kept attackers from scaling. That barrier is coming down, and it is coming down for defenders too, which is really the only reason to feel okay about any of this. The teams that adjust their triage logic now, instead of waiting for their own RefluXFS moment, are going to be in a much better spot a year from now.

References and Further Reading

Red Hat — Navigating the Mythos-haunted world of platform security https://www.redhat.com/en/blog/navigating-mythos-haunted-world-platform-security
SecureWorld — Anthropic’s Claude Mythos Autonomously Discovers and Exploits Zero-Days https://www.secureworld.io/industry-news/anthropic-claude-mythos-finds-exploits-zero-days
Qualys Threat Research Unit — RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs
The Hacker News — OpenAI Expands Daybreak With GPT-5.5-Cyber https://thehackernews.com/2026/06/openai-expands-daybreak-with-gpt-55.html
Cloud Security Alliance — Claude Mythos: AI Vulnerability Discovery and Containment Failures https://labs.cloudsecurityalliance.org/research/ai-vuln-discovery-containment-claude-mythos-v1-0-csa-styled/
byteiota — Claude Code Found 23-Year-Old Linux Kernel Bug in Hours https://byteiota.com/claude-code-found-23-year-old-linux-kernel-bug-in-hours/
The Hacker News — New “Bad Epoll” Linux Kernel Flaw https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html
VentureBeat — Mythos autonomously exploited vulnerabilities that survived 27 years of review https://venturebeat.com/security/mythos-detection-ceiling-security-teams-new-playbook