The patches are the story
The line in Anthropic’s Mythos announcement that stuck with me wasn’t about the model. It was buried in the partner section: $4 million in direct donations to open-source security organizations, plus contracted triage teams to help maintainers process disclosures.
You don’t fund triage capacity for a problem you think is about discovery.
For three weeks the conversation about Project Glasswing has been about the model — what it can do, who has access, when comparable capabilities arrive from other labs. Important questions. But the move that tells you what Anthropic actually thinks the problem is doesn’t sit in the model. It sits in the donation line. They are paying humans to absorb the wave that Mythos generated.
That is the story most people are missing.
The widening
Mythos has found, by Anthropic’s own framing, “thousands” of high-severity vulnerabilities across operating systems and browsers. Some of them are in code that has shipped, untouched, for two decades. The 27-year-old integer overflow in OpenBSD is the headline number, but the volume is where the actual structural problem lives.
Discovery used to be the bottleneck. A skilled security researcher might find a handful of serious bugs in a quarter. Mythos changes the unit economics of finding by an order of magnitude that nobody has internalized yet. Now the bottleneck moves downstream. Someone has to read each disclosure, validate it, write the patch, get it reviewed, ship it, and convince every downstream consumer to upgrade.
The discovery side just got a frontier model. The patching side still has the same volunteer maintainer who is probably also their kid’s soccer coach and is doing this work in the evening because they care about it.
This is not hypothetical. The Glasswing partner list includes the Linux Foundation, the OpenJS Foundation, and the Python Software Foundation. The donation is not ceremonial. It is the only honest acknowledgment that the math does not work without it.
Reza Rezvani is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.
Where I had it wrong
For a solo builder running production infrastructure — and I include myself in this — the natural response to the Glasswing news is: that is not my problem. The big infrastructure players will absorb the wave, the bugs will get patched eventually, and my job is to keep building. I have a roadmap. Customers want features.
That framing only works if you do not think about your dependency tree.
openLEO ships with the dependency surface that comes with any modern agentic AI stack — the orchestration layer, the model SDKs, the database adapters, the auth middleware, the observability tooling. Every one of those packages has its own dependency tree.
Most of them go five or six levels deep before you are looking at code written by someone you have never heard of, in a repository that has not been touched since 2019.
I have not read most of that code. Neither have you.
When Mythos starts publishing patches against the OSS supply chain, and it will, those patches land in your dependency tree whether you are paying attention or not.
The question is whether you are set up to know which patches matter to you, or whether you find out three months later when someone exploits a vuln in a transitive dependency you did not know you shipped.
The argument
Most coverage of Glasswing has framed the asymmetry problem one way: 52 organizations have access to capabilities the rest of us do not. That is the concentration angle, and it is real, but it points the wrong direction.
The actually urgent asymmetry is between the volume of disclosures coming from Mythos and the patching capacity of the maintainers downstream.
That asymmetry has consequences for everyone shipping code.
The first one is supply-chain math that gets worse before it gets better. The next twelve months will see a meaningful spike in CVEs against widely-used OSS packages. Some of those packages are in your package.json, your go.mod, your pyproject.toml. The patch cadence is going to be punishing if you are not already running automated dependency monitoring with a clear policy for what triggers an upgrade and what triggers a hold.
“I will deal with it when it matters” stops being viable as a strategy when the disclosure-to-exploitation window may close to days. Anthropic’s own estimate is six to eighteen months before comparable models exist outside Glasswing. If your security posture assumes you will patch when you can, you are underwriting risk you have not priced.
The second consequence is the one I have been sitting with the longest. Frontier models are going to find things in your own code too. Not just in your dependencies. In the code you wrote. The code your team wrote.
The code that passed review and shipped to production and that you stopped thinking about. Opus 4.7 is generally available.
Anthropic’s own red team blog said it plainly: the previous generation of frontier models was already extremely competent at finding vulnerabilities. If you have not pointed one at your own codebase, you are choosing not to know.
I think most solo builders and small-team CTOs are going to find this out the hard way. Not because they are careless. Because the operational muscle of “scan your own code with a frontier model on a regular cadence, triage the findings, ship the patches” does not yet exist as a habit. It exists as a thing you have heard of.
The cost
Holding this position has changed how I spend my week.
I have moved more time toward dependency hygiene than I would like to admit. Reading changelogs. Reviewing what shipped in the last point release of a package I depend on transitively.
Writing notes to myself about which packages I would patch first if I had to triage a stack of 30 advisories on a Monday morning. None of it ships features. None of it is visible to the customer. I know exactly what it costs in roadmap velocity, and the answer is “more than I want.”
The honest version: it feels slow, and the part of me that wants to ship the next openLEO feature this week is genuinely arguing with the part of me that thinks the dep surface is undermaintained. I do not have a clean resolution. I have a working balance that I will revisit in a quarter.
What I will not do is wait for the right tool to land in my plan tier. Claude Security is Enterprise-only right now. That is a fine business decision on Anthropic’s part and a useless excuse for me. Opus 4.7 in the API is enough to start. The cost is API tokens and an hour of structured prompting against my own repo, not a procurement cycle.
The specific habit change I am still trying to make stick: a 90-minute block on Friday afternoons where I do nothing but read advisories against my dependency surface and make patch/hold decisions in writing. I have skipped it twice in three weeks. It is harder than it sounds, because the first time you do it you find out how much you have been deferring.
The second time you do it you find out you would rather be doing almost anything else. The third time you do it, it starts to feel like maintenance instead of dread. I am told.
What I am watching
The thing I am watching for over the next 90 days is whether the $4 million Anthropic put into maintainer support actually reaches the small projects. Foundations are easy to fund. The maintainer of a 12-star repo that ships in 800 production stacks is hard to fund and is exactly where the next CVE that ruins your week is going to come from.
If Glasswing’s downstream funding only flows to the foundations, the OSS supply chain absorbs the wave at the layer that has the most resources and the least need. The smaller projects — the ones doing the actual cryptographic primitives and parsing libraries that nobody thinks about — keep being run by tired volunteers who now also have an incoming queue of AI-generated disclosures.
The other thing I am watching: whether the Cyber Verification Program for Opus 4.7 becomes a meaningful credentialing layer or stays a paperwork exercise. If it works, it sets the template for how frontier capabilities get distributed to legitimate defenders without giving every adversary the same gun. If it does not, the next twelve months are going to be loud.
Your turn
When did you last patch a vulnerability in one of your own dependencies — not a Dependabot auto-merge, but one where you actually read the advisory, understood the exploit path, and made a deliberate decision?
If this resonated, the deep-dives go further than I can in a free post. $7/mo, $60/yr, or just hit reply — I read every email.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.