Nobody Approved October
Artificial intelligence has made software flaws cheap to find. Installing the fixes is another matter. This is a review of the vulnerability management space since the Mythos 5 cybersecurity freakout happened earlier this year.
On an afternoon in mid-May, dozens of Microsoft engineers and their managers gathered in a conference room in Redmond, with more joining online, to take stock of what an artificial-intelligence model had found in their code. Under Project Glasswing, Anthropic had given roughly 50 of the company's staff early access to Claude Mythos Preview, a model then available only to a handful of firms. The aim, according to the slides, was to harden "critical services before publicly available models catch up."
The haul was large. A recording of the meeting and internal documents obtained by ProPublica show that in April alone the model turned up 90 critical flaws and more than 140 important ones in SharePoint, Microsoft's document-sharing software. The plan was to fix the critical ones first and the important ones by August, 2026. The moderate ones could wait, and low-severity bugs did not get any attention at all.
What Microsoft's engineers find, its customers must install, and the October batch arrives later today. In July the company warned them to expect bigger security releases every month, as its own AI scanning tools joined the search. The warning, if anything, understated things. By the count of Dustin Childs of the Zero Day Initiative, who dissects each release, Microsoft averaged about 95 new vulnerabilities a month last year. In September 2026 he counted more than 970 in a single release.
Nor is Microsoft alone. Linus Torvalds, who two years ago put the AI business at 90 percent marketing, now calls the swollen Linux release candidates, many of their fixes found by AI review, the new normal.
Installation has gone the other way. The 2026 Verizon's Data Breach Investigations Report tracked how thousands of organizations dealt with flaws known to be under attack. The median time to fix one fully had stretched from 32 days to 43, a measure of last year, before the summer's deluge.
Some years ago the Cyentia Institute, a research outfit, studied data from about 300 organizations. A typical one closed roughly one in ten of its open vulnerabilities in a given month, whatever its size. Wade Baker, one of the institute's founders, read that as a ceiling on how much any organization can fix in a set period.
Call the distance between what vendors ship and what organizations install the Absorption Gap. Measuring it takes two counts a month for each platform. One is emission: what vendors shipped, counted without weighting for severity and taken from a single tracker, since trackers seldom agree about the size of a release. The other is absorption, meaning what was installed and confirmed, a stricter test than approved or scheduled. The difference, added to the previous month's, is a backlog that might be called carry, and it is the figure an audit committee ought to see, by tier and with its trend. A raw tally of vulnerabilities only ever rises, so within a couple of quarters it tells nobody anything.
