Reported spike in high-severity vulnerability disclosures follows Anthropic’s cybersecurity model announcement

Epoch AI’s data insight reports that organizations disclosed approximately 1,300 high- and critical-severity Common Vulnerabilities and Exposures (CVEs) in June 2026, a figure roughly 3.5 times higher than the previous monthly record before Anthropic’s April 2026 announcement of Claude Mythos Preview.

The analysis centers on vulnerability disclosures from 21 notable organizations, including Microsoft, Google, Apple, Adobe, Oracle, Cisco, IBM, Red Hat, Intel, AMD, NVIDIA, Qualcomm, Samsung, SAP, Amazon (AWS), VMware (Broadcom), GitHub, Linux, Mozilla, Apache, and OpenSSL. Epoch AI excludes submissions from less reputable sources to avoid noise.

The report notes that Anthropic’s Project Glasswing, a collaborative effort involving partners such as Microsoft, Google, Apple, and AWS, claims to have identified over 10,000 high- or critical-severity vulnerabilities since its commencement, many of which have not been individually disclosed. OpenAI is also reported to be undertaking similar efforts with its Daybreak product.

Epoch AI emphasizes that its figures are based on publicly disclosed vulnerabilities and do not include discovered but undisclosed vulnerabilities. The analysis acknowledges that while increased feasibility of discovery due to AI tools may contribute to the spike, the rise in disclosures could also stem from heightened interest in bug discovery.

The data visualization and underlying CSV dataset are available for public use under a Creative Commons BY license, with the analysis authored by Luke Emberson and published on July 2, 2026.