Cloud and security company Cloudflare disclosed results from deploying Anthropic\'s Mythos preview on its infrastructure. As a participant in Anthropic\'s Project Glasswing, it applied Mythos to more than 50 internal repositories and shared what it found and the limits it encountered. Cloudflare highlighted strengths in building attack chains and generating proof of exploitability, and said patch speed after vulnerability disclosure can be risky if regression testing is skipped.

A widely used software package, Axios, was hacked after attackers took over a maintainer account, added a new dependency and shipped an update. The added package installed a tailored remote-access trojan and erased traces, while many security tools failed to flag it. Andreessen Horowitz partners said the case shows software supply-chain risk rising as AI coding spreads. They cited research finding AI agents more often pick vulnerable versions and enable new attacks such as slopsquatting, while detection remains slow in the industry.