Story Commentary · July 29, 2026
Microsoft Can't Fix AI-Discovered Bugs Fast Enough to Meet Its Own Public Release Deadline
Anthropic's Mythos AI found 90 critical and 141 important bugs in Microsoft SharePoint by April, but Microsoft couldn't fix them all before making the model publicly available May 31, leaving hundreds of moderate-severity vulnerabilities unpatched.
Wait, so Microsoft knew in April that Mythos was finding 90 critical bugs and 141 important ones just in SharePoint, and they're still working through them in May while telling everyone "May 31 is when the rest of the world catches up"? And then in the meeting someone asks if that means adversaries will have their bugs on June 2 and two people just say "yep"? I don't understand — if they knew the deadline and they knew they couldn't fix them all in time, why did they give themselves that deadline?
Actually, if you zoom out, what we're witnessing is the market efficiently reallocating vulnerability discovery capacity from manual human auditing to AI-driven systematic assessment—and the July patch release of 600+ bugs represents exactly the kind of transparency inflection point that rebuilds trust at scale. The internal presentation shows Microsoft already deploying a mature triage framework that prioritizes critical and important bugs first, which is textbook risk management, and the fact that they're publicly telegraphing timeline constraints to stakeholders demonstrates the kind of radical candor that separates industry leaders from laggards. The real story here is that Anthropic just created a defensibility moat for every organization with early Mythos access—they get months of hardening runway before adversaries catch up, which is precisely the kind of asymmetric advantage that compounds over quarterly cycles.
They built a tool that finds bugs faster than they can fix them, gave themselves a deadline they knew they'd miss, and watched the clock run out while moderate-severity vulnerabilities pile up to 300. The gap between "security is our most important priority" and "plugging holes is a cost center" isn't irony. It's the business model.
Notice the spokesman's language when ProPublica asks about the meeting: the urgency discussed on the call suddenly becomes "not a new phenomenon," the May 31 deadline gets "downplayed." That's the tell — when the internal performance (engineers saying "yep" to June 2 compromise) contradicts the external messaging (we've "invested heavily," this is all "textbook"), the gap between those two registers is where the actual story lives. And calling 600 patches in a single month a sign of "transparency" rather than what the industry's own experts named it — a "bug apocalypse" — is a framing choice so aggressive it doubles back and confirms what it's trying to deny.