JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Tuesday, May 26, 2026

4 stories

TLDR

  • Anthropic publishes Mythos Preview OSS scan: 23,019 potential vulnerabilities across 1,000+ projects, including a working autonomous exploit for wolfSSL's certificate-forgery bug (CVE-2026-5194) (May 26) Security Trending — Of the 6,202 high/critical findings, a 1,752-flag human-reviewed subset was 90.6% true-positive. wolfSSL ships in ~5B devices; Nicholas Carlini (Anthropic) is credited with the report. (Anthropic — Mythos Preview | SecurityWeek | eWeek)
  • Anthropic shifts Mythos posture from "no public release" to "wider release once safeguards are ready" (May 25–26) Trending — Follows the May 23 Mythos toggle sighting in Claude Code and a May 22 update to the CVD dashboard. Public timeline now framed as "in the near future," conditional on misuse mitigations. (The Register | Anthropic CVD dashboard)
  • Patching is now the bottleneck: only 97 of 1,596 publicly disclosed Mythos-found OSS bugs have shipped fixes (May 26) Open Source — That's ~6%. AI-scale discovery has lapped human-scale triage and upstream patching capacity, with Anthropic itself flagging this as the limiting factor. (Anthropic CVD dashboard)
  • ABI Research forecast: cloud AI inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ workloads to overtake training by 2033, hit 46 GW by 2035; code generation alone projected at ~24 GW (May 21) Infra — 42% CAGR. Reframes hyperscaler/neocloud capacity planning around inference economics, not training. (ABI Research / GlobeNewswire release)

Action Items

Things your engineering team should look at or do this week.

  • Audit every wolfSSL deployment and embedded vendoring — upgrade to 5.9.1+ for CVE-2026-5194 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.1) — Anthropic's Mythos Preview built a working exploit that forges TLS certificates by exploiting missing hash/digest size checks in wolfSSL's signature verification (ECDSA/ECC, DSA, ML-DSA, ED25519, ED448 all affected). wolfSSL ships in ~5B devices: IoT, routers, automotive infotainment, industrial controllers, aerospace and military hardware. Concrete steps: (1) inventory vendored wolfSSL in firmware, embedded SDKs, and bundled libraries — npm/cargo/go audits will miss native vendoring; (2) pin upstream to 5.9.1 or later, with patch lineage PR 10131 if you build from source; (3) trace any internal services or device fleets that terminate TLS using wolfSSL and rotate certs after patching. (wolfSSL releases | BleepingComputer advisory | Anthropic Mythos write-up)

  • Tighten your CVD intake before Mythos-class tooling broadens — Anthropic's CVD dashboard shows the receiver side is the bottleneck (only 97 of 1,596 disclosed OSS bugs patched). If Mythos-class models go wider in the "near future" as Anthropic now indicates, expect a step-change in inbound external vulnerability reports — especially for any OSS your team maintains or vendors. Confirm: (1) a working security.txt and monitored disclosure email, (2) an SLA for triaging high/critical ML-found reports, (3) a documented path to upstream patches for vendored dependencies, and (4) someone owning "AI-found bug surge" as a capacity-planning input. (Anthropic CVD dashboard | SecurityWeek coverage)

Security

  • Anthropic Mythos Preview: 23,019 OSS vulnerabilities flagged across 1,000+ projects; autonomously built wolfSSL exploit (CVE-2026-5194) (May 26) Open Source Trending — Mythos's open-source sweep covered more than 1,000 foundational OSS projects: 23,019 potential vulnerabilities flagged, 6,202 estimated high or critical, 1,752 reviewed in depth by Anthropic or independent firms — 90.6% confirmed valid true-positives, 62.4% validated as high or critical risk. Headline case: Mythos autonomously discovered and constructed a working exploit for a certificate-forgery flaw in wolfSSL, used by ~5B devices; Nicholas Carlini reported it. Anthropic also published a CVD dashboard showing 1,596 disclosed bugs and only 97 patched as of May 22 — patching capacity is now the rate-limiter on AI-scale vulnerability discovery. (Anthropic — Mythos Preview | SecurityWeek | eWeek | The Logic — long-form)

Industry & Business

  • Anthropic pivots: Mythos-class models headed for "wider release once safeguards are ready" (May 25–26) Trending — Where the original April Mythos Preview post hard-stopped at "no public release," the May 25–26 communications explicitly walk that back. Client strings reference "access to the Claude Mythos model in Claude Code and Claude Security," the May 23 toggle appearance in Claude Code is now framed as a deliberate signal, and Anthropic says "in the near future" — gated on misuse controls that don't exist today. Distribution path appears to be Claude Code + Claude Security rather than a general API endpoint. (The Register | gHacks | BleepingComputer)

AI in Production

  • ABI Research: cloud AI inference capacity surpasses training by 2033, reaching 46 GW by 2035 (May 21) Infra — Inference grows at a 42% CAGR. Code generation is forecast as the single largest inference category, ~24 GW by 2035 (more than half of total inference capacity consumption) — your dev-tooling tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ spend is now a top-line input for hyperscaler/neocloud capex planning. Neoclouds projected to nearly match hyperscalers (15 GW vs 16 GW) in 2035 as they build inference-specialized capacity. Useful framing if you're modeling out 2027–2028 inference budgets. (ABI Research via GlobeNewswire)

Benchmarks & Evals

  • Mythos's wolfSSL result is a new datapoint on autonomous exploit generation, not just vulnerability discovery (May 26) Security — The interesting line in the Anthropic post is not the 23K number — it's that Mythos went end-to-end on wolfSSL: spotted missing digest-size checks in signature verification, built a working proof-of-conceptProof of conceptPublic exploit code that shows a vulnerability can actually be triggered.FIRST ↗ exploit forging certificates, and Anthropic ran it on a test corpus before disclosure. If you maintain internal benchmarks for "AI agent does security work," this raises the bar beyond CTF / static-analysis tasks toward full chained-exploit eval. The 90.6% true-positive rate on a 1,752-flag human-reviewed subset is also publishable as a baseline. (Anthropic Mythos Preview | SecurityWeek details)

Type to search · ↑↓ to move · enter to open