The Quiet

I published The Dress Rehearsal on a Wednesday. By Friday, I was listening for what should have come next.

It's eerily quiet.

Anthropic handed their most dangerous model to more than forty organizations on April 7. Apple, Amazon, Microsoft, Google, Cisco, Broadcom, the Linux Foundation.¹ The assignment: find and patch critical infrastructure vulnerabilities before similar capabilities reach anyone else. Eighteen days later, from where I sit, the air is still.

I'm on Arch Linux. I get patches every day. That's normal. What's not normal is the absence of noise. When Microsoft ships a bad update, the forums catch fire within hours. When Apple pushes an emergency fix, the tech press runs it for a week. Mythos is supposedly rewriting the cybersecurity landscape, and the loudest thing I've heard about it since April 7 is my own article.

What the Numbers Say

The patches are there if you know where to look.

Microsoft's April 14 Patch Tuesday addressed 165 vulnerabilities. Second-largest monthly release in the company's history.² Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, wrote that AI-discovered vulnerability submissions have "essentially tripled, making triage a challenge."² OpenBSD pushed five X-server CVE fixes on April 14, seven days after Mythos shipped to its partners.³ Adobe released an emergency zero-day patch on April 11.⁴

165 CVEs. Tripled submissions. Second-largest month on record. Nobody's talking about it.

The record month happened. It just happened quietly.

Transparent Wings

Project Glasswing is named after a butterfly that hides by being see-through. The name is doing exactly what the butterfly does.

Adam Barnett at Rapid7 told Krebs on Security it's "tempting to imagine" the April spike was tied to Glasswing, but attributed the volume instead to "ever-expanding AI capabilities" generally.⁴ The press is being careful. Anthropic's design ensures they can be. For most of the vulnerabilities Mythos found, Anthropic published only cryptographic hashes, promising to reveal specifics "after a fix is in place."¹

Named after a butterfly that hides by being transparent. So far, perfect camouflage.

Partners can't publicly say "Mythos found this." Researchers can't verify which patches came from the consortium and which came from routine fuzzing. The most consequential cybersecurity event of 2026 is being absorbed into normal patch queues, unlabeled, indistinguishable from Tuesday.

The Math

The numbers don't add up to safety. Anthropic says Mythos found "thousands" of zero-day vulnerabilities across every major operating system and browser.¹ Most of those hashes haven't been matched to public patches. The surge we can see, record-setting as it is, covers a fraction of what was actually found.

And the consortium is forty-plus organizations. Hundreds of engineers with access to a model that discovers exploits while they sleep. Secrets at that scale have a half-life measured in weeks, not years.

The quiet is engineered. It's also temporary. Somewhere between Anthropic's hashed disclosures and a researcher's late-night curiosity, the signal will break through. The patches will still be arriving. The silence won't.

---

References

Footnotes

1. Anthropic. (2026). "Project Glasswing: Securing critical software for the AI era." Anthropic ↩ ↩² ↩³

2. Montalbano, E. (2026). "Microsoft drops its second-largest monthly batch of defects on record." CyberScoop ↩ ↩²

3. OpenBSD. (2026). "OpenBSD 7.7 Errata." OpenBSD ↩

4. Krebs, B. (2026). "Patch Tuesday, April 2026 Edition." Krebs on Security ↩ ↩²