09/06/2026
Developers across the planet are under attack. Mythos showed this is only the beginning.
Every so often the industry gets news after which you can no longer pretend everything is following the old script. In the spring and summer of 2026, two such pieces of news arrived at once.
The first is a new wave of attacks on software supply chains. Attackers have shifted their focus far deeper — away from users’ computers and servers and onto the machines and tools of the developers who build software. This isn’t a single attack or a single compromised package, but a whole tangle of them: Megalodon, Mini Shai-Hulud, Glassworm, and compromises of npm, PyPI, GitHub Actions, VS Code and OpenVSX extensions, as well as CI/CD environments and OIDC tokens.
The second is the interim results of Anthropic’s Project Glasswing and its Claude Mythos Preview model. It has already found thousands of serious vulnerabilities in critically important software. Its productivity is telling. In just a few weeks, Mythos and around 50 Anthropic partners uncovered roughly 23,000 findings, of which more than 6,000 are high- and critical-severity vulnerabilities. For comparison: across all of 2025, about 48,000 CVEs were registered worldwide. In other words, a single tool produced, in weeks, a stream of findings comparable to several months of vulnerability registration across the entire planet.
Both stories are signs of a new front line in the war with attackers — and of a fundamental shift in application security. Let’s look at this news more closely, starting with the first.
Learn more https://www.h-x.technology/news/new-front-line-application-security
