July vulnerability disclosures ran five times the record
Epoch AI counted around 2,500 high- and critical-severity vulnerabilities disclosed in July, about five times the monthly record before the Claude Mythos Preview announcement.
Why it matters
What autonomous vulnerability discovery did to the public disclosure record was measured for the first time, on a counting rule fixed before the event.
The publication is dated 31 July 2026. In July, notable organisations published around 2,500 high- and critical-severity CVEs: 606 critical and 1,906 high. That is about five times the monthly record prior to the Claude Mythos Preview announcement in April 2026. Epoch revised that prior record upward, from roughly 440 to roughly 490, because severity ratings and disclosure records are amended over time. The data comes from cve.org and the analysis is limited to 21 notable organisations. Epoch notes the spike may be caused in part by increased interest in finding bugs, presenting the association as a coincidence in time rather than a demonstrated cause.