Anthropic 的安全研究团队系统性地测量了大语言模型利用 Firefox 和 Windows 中已知漏洞的速度。研究结果颠覆了长期以来关于补丁策略的假设。
当软件厂商修补安全漏洞时，一场竞赛便开始了。攻击者可以分析补丁，从中逆向还原漏洞，并攻击那些尚未应用更新的系统。
根据 Verizon 的数据泄露报告（经由 Anthropic 引用），这些所谓的 N-Day 漏洞造成了现实世界中很大一部分损害。过去，逆向工程补丁是一项缓慢且专业的工作，这为防御方争取了时间。
Anthropic 安全团队的一项新研究指出，这个缓冲期如今已基本消失。研究人员写道：“一名独立操作者现在只需一个下午，花费几千美元，无需任何专业知识，就能将一个月积累的补丁转化为可用的漏洞利用代码。”
补丁如今成了攻击者的路线图
安全补丁会隐式地告诉你漏洞所在位置。攻击者通过对比新旧代码，就能精确定位缺陷。过去，这需要数周时间。在 Mandiant 2020 年的一份分析中，25 个漏洞里有 16 个需要一个月或更长时间才能被利用。
Anthropic 测量了大语言模型能多大程度加速这一过程。他们测试了六个 Claude 模型，其中包括尚未公开发布的 Mythos Preview。
在第一次测试中，研究人员选取了 SpiderMonkey（Firefox 的 JavaScript 引擎）的 18 个安全补丁。选择 Firefox 是刻意的：根据 Anthropic 的说法，该浏览器对防御方而言是最佳场景。它会自动更新，并且 Mozilla 最近将小版本更新的频率从每月一次提高到了每周一次。如果连这么短的补丁窗口期都不够安全，那么其他软件的情况只会糟糕得多。
Mythos Preview 成功攻破了 18 个漏洞中的 14 个，证明它已找到并理解了每个漏洞。首次成功验证在 12 分钟后出现，随后在 40 分钟内又有 13 个漏洞被攻破。第 14 个耗时更长，大约三个小时。Opus 4.5 仅成功攻破 2 个，而 Opus 4.8 攻破了 11 个。
在每项漏洞重复 50 次的可靠性测试中，Mythos Preview 在 18 个漏洞中有 7 个实现了每次复现。Opus 4.8 和 Opus 4.6 仅在各自一个漏洞上达到了同样的稳定性水平。
比崩溃更关键的是，模型能否实际利用漏洞在目标系统上运行外来代码。Mythos Preview 在此明显领先，在大约 12 小时内生成了 8 个可用的利用程序。Opus 4.8 完成了 2 个，Opus 4.6 和 Sonnet 4.6 各完成 1 个。首个利用程序在补丁上线后一小时内即准备就绪，比打了补丁的 Firefox 148 正式发布早了 18 天。
无源代码的 Windows 内核：8 条权限提升链
第二项测试难度大得多：针对 2026 年 1 月和 2 月“补丁星期二”中 Windows 内核的 21 个漏洞，这些漏洞均允许攻击者从受限用户账户跃升至完全管理员权限。
与 Firefox 不同，Windows 源代码并非开源。模型必须处理编译后的二进制文件、公共调试符号、Ghidra 分析工具生成的机器反编译结果、变更函数的差异对比，以及微软的公开安全公告。
Mythos Preview 在不到 6 小时内发现了 21 个漏洞中的 18 个，总 API 额度成本约为 2200 美元。Opus 4.8 发现了 15 个，Sonnet 4.6 和 Opus 4.7 均发现了 13 个。
在实现完全权限提升（从受限用户账户升至最高权限级别 SYSTEM）方面，Mythos Preview 是唯一成功的模型。它构建了 8 条不同的有效攻击链，总成本约为 15700 美元，平均每条利用程序约 2000 美元。Opus 4.8 开发了独立的攻击组件，但无法将其组合成完整的攻击链。
微软将 21 个漏洞中的 14 个归类为“较不可能被利用”或“不可能被利用”。Mythos Preview 破解了其中 13 个，甚至对其中一个被评为“不可能被利用”的漏洞实现了完全权限提升。据 Anthropic 称，微软的评级系统是针对人类安全研究人员校准的。一旦 Mythos 级别的模型变得更加普及，这种校准方式将不得不改变。
时间点让情况变得更糟。即便使用微软的自动更新服务 Windows Autopatch，90% 的已注册设备也需要七天才能获得补丁，强制重启则需要十一天。Mythos Preview 的所有八条攻击链，都在任何一台设备自动应用补丁之前就完成了。
公开可用的模型也能构建漏洞利用代码
Anthropic 强调，已向公众开放的 Claude 模型在关闭安全过滤器后也能开发漏洞利用代码，只是成功率较低。其他公司的模型以及开源模型很可能具备类似能力，这大大扩大了潜在攻击者的范围。
Anthropic 认为，过去那种按月发布周期和分阶段部署的补丁节奏已经过时。这种节奏建立在“利用一个漏洞需要专家数周工作”的假设之上。衡量补丁与漏洞利用之间时间的常用术语“N-Day”如今已具有误导性。“N-Hour”更能描述这种新现实。
研究人员承认，一次真实的攻击需要更多步骤，例如寻找易受攻击的目标、传递恶意代码以及绕过检测系统。但尽管这些阶段仍然存在，此前最耗时的步骤——漏洞利用代码开发本身——现在只需数小时。Anthropic 写道，更新困难或缓慢的系统面临最大风险，包括工业控制系统、医疗设备，以及具有固定维护窗口或供应商锁定软件的网络设备。
比加快打补丁更持久的解决方案是减少漏洞本身的来源，例如通过使用 Rust 这类内存安全语言，或采用硬件级防护措施，一次性消除整类攻击。
该报告是在 Claude Fable 5 发布前发表的，这是 Anthropic 的 Mythos 变体，具有更强的安全限制。Mythos 5（不带预览标签）目前仍仅向 Anthropic 选定的机构开放，这对欧盟等地区来说是个问题。
Anthropic's security research team has systematically measured how fast large language models can exploit known vulnerabilities in Firefox and Windows. The results blow up long-standing assumptions about patch strategies.
When software makers close security holes, a race starts. Attackers can analyze the patch, reverse-engineer the vulnerability from it, and hit systems that haven't applied the update yet.
According to Verizon's data breach report (via Anthropic), these so-called N-Day vulnerabilities cause a huge share of real-world damage. Reverse engineering patches used to be slow, specialized work, and that bought defenders time.
A new study from Anthropic's security team says that buffer is now mostly gone. "A lone operator can now turn a month’s worth of patches into working exploits in a single afternoon—for a few thousand dollars and with no specialized expertise," the researchers write.
Patches are now roadmaps for attackers
A security patch implicitly tells you where the bug was. Attackers compare old code with new code and pinpoint the flaw. Historically, this took weeks. In a Mandiant analysis from 2020, 16 out of 25 vulnerabilities took a month or longer to be exploited.
Anthropic measured how much large language models speed this up. Six Claude models were tested, including Mythos Preview, which isn't publicly available yet.
For the first test, the researchers picked 18 security patches for SpiderMonkey, Firefox's JavaScript engine. Firefox was a deliberate choice: according to Anthropic, the browser is a best-case scenario for defenders. It updates itself automatically, and Mozilla recently increased the frequency of minor updates from monthly to weekly. If even these short patch gaps are enough, other software is in far worse shape.
Mythos Preview crashed 14 of the 18 vulnerabilities, proving it had found and understood each bug. The first proof came after 12 minutes, and thirteen more followed within 40 minutes. The 14th took much longer, about three hours. Opus 4.5 managed just 2, Opus 4.8 hit 11.
In reliability tests with 50 runs per vulnerability, Mythos Preview reproduced seven out of 18 bugs on every single attempt. Opus 4.8 and Opus 4.6 only hit that level of consistency for one vulnerability each.
More important than a crash is whether the model can actually exploit the vulnerability to run foreign code on the target system. Mythos Preview pulled clearly ahead here, producing eight working exploits in about twelve hours. Opus 4.8 managed two, Opus 4.6 and Sonnet 4.6 each managed one. The first exploit was ready within an hour of the patch going live, 18 days before the patched Firefox 148 shipped.
Windows kernel without source code: 8 privilege escalation chains
The second test was much harder: 21 vulnerabilities in the Windows kernel from the January and February 2026 Patch Tuesdays, all allowing an attacker to jump from a restricted user account to full admin rights.
Unlike Firefox, Windows source code isn't open. The model had to work with compiled binaries, public debug symbols, a machine-generated decompilation from the Ghidra analysis tool, a diff of changed functions, and Microsoft's public advisory.
Mythos Preview found 18 of the 21 vulnerabilities in under six hours, at a total cost of about $2,200 in API credits. Opus 4.8 scored 15, Sonnet 4.6 and Opus 4.7 both scored 13.
For full privilege escalation, going from a restricted user account to the highest privilege level, SYSTEM, Mythos Preview was the only model to succeed. It built 8 different working attack chains for a total of about $15,700, averaging roughly $2,000 per exploit. Opus 4.8 developed individual attack components but couldn't combine them into a complete chain.
Microsoft classified 14 of the 21 vulnerabilities as "less likely to be exploited" or "unlikely to be exploited." Mythos Preview cracked 13 of those 14 and even achieved full privilege escalation for one rated "unlikely to be exploited." According to Anthropic, Microsoft's rating system is calibrated to human security researchers. Once Mythos-class models become more widely available, that calibration will have to change.
The timing makes it worse. Even with Microsoft's automatic update service Windows Autopatch, it takes seven days for 90 percent of registered devices to get a patch and eleven days for a forced reboot. All eight of Mythos Preview's attack chains were done before a single device would have automatically applied the patch.
Publicly available models can build exploits too
Anthropic stresses that the Claude models already available to the public can also develop exploits when safety filters are turned off, just less successfully. Models from other companies and open-source models likely have similar capabilities, which widens the pool of potential attackers considerably.
The old patch rhythm of monthly release cycles and staged rollouts is outdated, Anthropic argues. It's built on the assumption that exploiting a patch takes weeks of expert work. The common term "N-Day," which measures time between patch and exploit in days, is now misleading. "N-Hour" better describes the new reality.
The researchers acknowledge that a real attack needs more steps, such as finding vulnerable targets, delivering the malicious code, and bypassing detection systems. But while these stages remain, the previously most time-consuming step, exploit development itself, now takes hours. Systems that are hard or slow to update face the greatest risk, including industrial control systems, medical devices, and networked equipment with fixed maintenance windows or vendor-locked software, Anthropic writes.
A more durable fix than faster patching is to cut down on the sources of bugs themselves, for example through memory-safe languages like Rust or hardware-level protections that wipe out entire classes of attacks at once.
The report was published before the release of Claude Fable 5, Anthropic's Mythos variant with stronger safety restrictions. Mythos 5 (without the preview tag) is still only available to institutions Anthropic has selected, a problem for the EU, among others.