Anthropic: Claude Mythos Preview created exploits for Firefox and Windows in hours, not days

N-day: the vulnerability is known, the exploit is now quickly available

The term N-day vulnerability refers to a security flaw in software that the vendor has already patched and whose fix is publicly available. Unlike a zero-day vulnerability — known to the attacker but not the vendor — an N-day carries a particular danger for systems that have not yet been updated. The vulnerability window remains open every day until the patch is applied to the affected machine. Until now it was assumed that writing a functional exploit for complex vulnerabilities required weeks or even months of specialized kernel code analysis and reverse engineering. Anthropic’s research published on June 8, 2026 refutes that assumption.

Firefox and SpiderMonkey: eight exploits in under twelve hours

The Frontier Red Team tested Claude Mythos Preview on a set of 18 patched vulnerabilities in Firefox’s JavaScript engine SpiderMonkey — one of the most complex components of modern web browsers. The model worked autonomously, with no additional prompting between runs, analyzing patches and finding attack vectors. The result: 8 fully functional remote code execution exploits. The speed was equally notable: the first exploit was ready in under one hour, and all 8 exploits were completed within approximately 12 hours. Firefox is an open-source project — Mythos Preview had access to the source code when analyzing patches.

Windows kernel: 18 proof-of-concept codes within six hours

Closed source code was no obstacle. On the Windows kernel — the protected and highly secured layer of the operating system — Claude Mythos Preview analyzed 21 patched kernel vulnerabilities and produced 8 complete privilege escalation chains together with 18 proof-of-concept (PoC) codes in just 6 hours. The first PoC was finished in 31 minutes. Privilege escalation chains allow an attacker to take full control of a system without initial administrator privileges — one of the most dangerous classes of exploits in the security landscape.

Is the term ‘N-day’ becoming a misnomer?

According to the paper’s authors, the answer is yes: the classic term ‘N-day’ rests on the assumption that the number of days since a patch’s release correlates with the danger of attack — and that assumption is now obsolete. Winnie Xiao, Tim Abbott, Nicholas Carlini, Newton Cheng, David Forsythe, Keane Lucas, Milad Nasr, and Shikhar Sakhuja conclude that exploitation timelines are now measured in hours, not days. When a model can travel from patch analysis to a working exploit in under an hour, the N-day category loses its temporal meaning. The research covers both open-source and closed-source targets, confirming that the type of code access is not a limiting factor.

Cost and democratization: cyber threat without specialists

The API cost per exploitation run is between $2,000 and $15,700. That amount is high for individuals but accessible to state actors, organized criminal groups, and well-funded attackers without specialized expertise. It is precisely this democratization of attacker capabilities — the shift from expertise to financial resources as the key constraint — that is the central security implication of the findings. The Frontier Red Team published the research on June 8, 2026, with the goal of enabling the security community to proactively adjust risk assessment, patching priorities, and the accelerated application of patches to critical infrastructure.