The AI Vulnerability Race Is Accelerating, and It’s Highlighting a Concentration Risk Problem

Introduction

In the span of two weeks, Anthropic published new research on what Mythos can actually do, and OpenAI launched Daybreak. Put them side by side and the picture is clear: AI-powered vulnerability discovery is no longer one company's project. It is becoming standard capability. That matters for every organization managing third-party risk, and here is why.

All of it connects back to the same underlying problem: concentration risk. In a supply chain context, that means the shared software libraries, platforms, and dependencies that run inside hundreds of your vendors' products simultaneously. When one of those shared components has a vulnerability, the exposure is not isolated to one vendor relationship. It lands across your entire ecosystem at once, whether any of your vendors know it or not, and whether any of them disclose it or not. 

The research and announcements from the past few weeks make that problem more urgent in ways that are worth understanding carefully.

What Mythos Has Actually Been Finding

Since February 2026, Mythos has been scanning open-source software: the libraries and frameworks that sit inside the products your vendors build and run. By late May it had surfaced over 23,000 candidate vulnerabilities and formally disclosed 1,596 of them across 281 open-source projects, all tracked on the Mythos CVD dashboard. Only 97 had been patched.

That patch number is the important one. These are not vulnerabilities in products from companies with security teams and remediation SLAs. Most open-source software is maintained by individual developers contributing their work to the community. When a vulnerability is found in a library one person maintains in their spare time, there is no response process waiting on the other end. The fix comes when it comes, or it does not. Meanwhile, that library is running inside software your vendors use every day. 

This is what makes the Mythos CVD dashboard worth paying attention to beyond the headline numbers. The 1,596 disclosures are a window into the shared infrastructure underneath your vendor ecosystem, and the 97 patches tell you how slowly that infrastructure gets hardened even when vulnerabilities are formally reported. For concentration risk, this is where the story starts: the libraries Mythos is scanning are the same ones running inside your vendors' products right now, and most TPCRM programs have no visibility into them.

How Fast Those Findings Can Become Weapons

Finding a vulnerability and exploiting it are two different problems. Anthropic's exploit evals paper, also published May 22, measures how well Mythos can do both. On ExploitGym (a benchmark using 898 real patched vulnerabilities across widely deployed software including the V8 engine and the Linux kernel) Mythos achieved working code execution on 157 tasks within two hours. 

What that gap means practically: the time between a vulnerability being discovered and it being weaponized is compressing. As we reported in the 2026 Supply Chain Vulnerability Report, Mandiant found that by 2025, attackers were already exploiting vulnerabilities an average of seven days before public disclosure. As Mythos-level capability becomes more widely available over the next 6 to 12 months, that window will compress further. For supply chain risk programs built around CVE feeds and periodic assessments, that compression is the core operational problem. By the time a vulnerability is publicly disclosed, the window to act may already be closing.

For concentration risk specifically, exploit velocity is a timing problem. If a shared dependency has a flaw and it can be weaponized quickly, the window to identify which of your vendors are exposed and act on it is very short — shorter than most programs are currently built for.

This Is Now an Industry Condition, Not One Lab's Project

The week before the exploit evals dropped, OpenAI launched Daybreak. It uses GPT-5.5 and Codex Security to scan enterprise software repositories and surface vulnerabilities, with Cisco, Cloudflare, CrowdStrike, Palo Alto Networks, and Oracle already integrated as partners.

The significance is not that Daybreak competes with Glasswing. It is that two major AI labs now have programs doing this, with major security vendors behind each of them. Open-weight models that do not observe responsible disclosure timelines are also in the mix. The volume of vulnerabilities being discovered across shared open-source infrastructure is going to increase, and the pace will not slow down while organizations wait to respond.

For concentration risk, what Daybreak confirms is that the rate of discovery across shared open-source infrastructure is going to keep accelerating. More tools, more findings, more pressure on the same shared substrate underneath your vendor ecosystem — and more urgency around knowing which of your vendors are running what.

What the Breach Data Already Shows

The 2026 Verizon DBIR gives us the current baseline before any of this fully plays out. 

• Third-party involvement in breaches jumped 60% year-over-year and now appears in 48% of all incidents. 
• Vulnerability exploitation surpassed stolen credentials as the top initial access vector for the first time, accounting for 31% of all breaches. 
• Median time to patch grew to 43 days. 
• Only 26% of critical CVEs in CISA's KEV catalog were fully remediated, down from 38% the year before.

Read those numbers alongside Black Kite's finding that the average vendor breach cascaded into 5.28 other organizations in 2025, up from 2.56 the year before, and a clear pattern emerges. 

• Breaches involving third parties are more frequent. 
• The vulnerabilities enabling them are being remediated more slowly. 
• And when a breach does happen through a shared dependency, it hits more organizations at once than it did twelve months ago.

CL0P's 2025 campaigns against Cleo Harmony illustrated exactly how this works in practice: find a shared dependency, compromise it once, and access hundreds of downstream organizations simultaneously. The math works because of concentration. The more widely a library or platform is embedded across a vendor ecosystem, the higher the return on finding a single flaw in it.

The DBIR numbers are what concentration risk looks like in breach outcomes. More third-party incidents, slower remediation, and each breach reaching further into the ecosystem than the one before it. The structural problem is already measurable, before AI-powered discovery has fully played out.

The Gap These Tools Do Not Fill

Glasswing and Daybreak scan source code. They are very good at finding vulnerabilities that have been sitting undetected in software for years, sometimes decades. What they do not do is tell you which of your vendors are running the affected library, which of those vendors sit at the center of your ecosystem where a compromise would cascade furthest, or which of the thousands of CVEs published this year actually matter to your specific supply chain.

That is the concentration risk problem. And it gets harder to manage as AI makes vulnerability discovery faster, open-source patch rates stay low, and third-party breach involvement keeps climbing.

The 48,000-plus CVEs published in 2025 are not all equal. Of more than 1,240 high-priority candidates Black Kite's research team analyzed, only 58 posed a critical threat to supply chains. That is the number that actually matters, not because of an arbitrary filter, but because when you look at severity, exploitability, and real-world exposure together, the signal collapses to a very small set. The 329 CVEs that were OSINT-discoverable received FocusTags®, and of those, the 58 with the highest exploitation probability are what we call Code Red. When you then add your specific vendor exposure (which vendors in your ecosystem are actually running the affected software) that number can drop to 10. Those are the ones that matter.

Finding them continuously, across your entire vendor ecosystem, before the window closes is what a program built for this environment actually looks like. FocusTags® surface the signal. Vulnerability Intelligence Briefs™ map CVE exposure across your monitored vendors. The Bridge™ closes the loop: rather than sending questionnaires asking vendors whether they are affected, it sends structured evidence showing exactly where the exposure exists on their infrastructure.

The tools getting better at finding vulnerabilities is not the problem. Knowing where those vulnerabilities land across your supply chain and acting on the ones that matter before someone else does — that is the work.

See how Black Kite maps concentration risk across your vendor ecosystem.