Mythos and the Price of Vibe Coding: 45% of AI-Generated Code Contains Vulnerabilities — and There Are Now Models That Can Find Them in Hours

Madrid. On April 7, Anthropic unveiled Claude Mythos, an AI model that has changed the rules of cybersecurity. At Logixs we have analysed its implications — and not just for security teams, but for the way organisations are adopting artificial intelligence as a whole. Our analysis was widely covered by outlets such as El Economista, CyberSecurity News, Cepymenews and Infonegocios Madrid, as well as El Economista's print edition.

What Mythos has proven

Mythos can autonomously discover thousands of vulnerabilities in operating systems and browsers, including flaws that went undetected for up to 27 years despite decades of human review and millions of automated tests. It also generates working exploits for 72% of the vulnerabilities it finds, completing in hours what would take a human team weeks.

Given its offensive potential, Anthropic chose not to release it publicly and launched Project Glasswing, a $100 million initiative restricting access to partners such as AWS, Apple, Microsoft and Google for strictly defensive use. Even so, on April 22 the model was accessed without authorisation through the compromised credentials of an external contractor. What the industry feared has already happened.

The numbers that size up the problem

This is not an isolated phenomenon, and the figures speak for themselves. 99% of large enterprises with cloud infrastructure already use AI agents to generate code, according to Palo Alto Networks' State of Cloud Security Report 2025. At the same time, roughly 45% of AI-generated code contains vulnerabilities, according to Veracode. And Mythos is not alone: models like OpenAI's GPT-5.4-Cyber and Google's Big Sleep are developing comparable capabilities. Concern has reached the institutions too: on April 16, the European Parliament submitted a formal question to the European Commission on how to prevent a potential "cybergeddon" and adapt the legislative framework to AI models with offensive capabilities.

The real problem isn't Mythos — it's how we're adopting AI

The most relevant thing about Mythos is not its offensive capability, but what it reveals about the moment companies are going through. The rise of vibe coding —building software with AI without deep technical expertise— is exponentially multiplying code production and, with it, organisations' attack surface. Right when those vulnerabilities can no longer stay hidden.

"Mythos is a wake-up call for the entire business ecosystem, not just for cybersecurity teams. The speed at which companies are generating software with AI cannot outrun security, traceability and human oversight. The problem is not artificial intelligence itself, but how it's being implemented: many organisations are layering AI on top of structures that aren't ready — without data governance, without code validation and without a clear framework guaranteeing that what gets built is secure. Mythos has simply proven that those gaps have real consequences."

Generating code isn't enough — you have to govern it

This new landscape forces a rethink of strategies, prioritising security, governance and oversight in an environment where AI doesn't just create, but can also exploit vulnerabilities at unprecedented speed. It's exactly the philosophy behind ADA, our agentic platform: every line of code automatically validated against security and compliance criteria, with end-to-end auditable traceability and human oversight on the final decision.