The Atlantic Council reported in June 2026 that Anthropic’s Mythos Preview turned recently disclosed Firefox and Windows kernel flaws into working exploits in hours, for roughly $2,000 each.

What this evidence bears on

• Supports: AI can now turn a disclosed bug into a working exploit in hours, so a quiet past says little about the next year.

  • A reply in “Keep 90 days”

• Supports: Attackers have the same AI tools, so a bug one company finds is likely to be found by someone else long before 90 days pass.

  • A reason for “Shorten the deadline”

• Supports: Attackers won’t slow down to match a project’s capacity, so a longer embargo mainly keeps users in the dark.

  • A reply in “Give maintainers more time”