The Vulnpocalypse, Three Months On: 622 CVEs, an Export Ban, and What Actually Happened

What has changed since the vulnpocalypse warning?

In May, this story was a forecast. Palo Alto Networks had found 75 bugs in a month against a normal rate of five, Mozilla had patched 423 Firefox flaws, and the industry was working from a three-to-five month estimate of how long defenders had before AI-assisted exploitation became routine.

That window is now more than half spent, and three things have happened that the May framing did not anticipate. Patch volumes did not plateau — they went vertical. The US government intervened directly in the availability of a frontier model, briefly removing it from the market entirely. And the first credible reporting emerged of an AI system originating a vulnerability discovery and a working exploit without a human in the loop.

Taken together, they make the picture both more alarming and more complicated than “AI finds bugs, attackers get AI, everything breaks.”

How bad has the patch volume actually become?

Worse than the May numbers suggested, and the counting has itself become a problem.

Microsoft’s July 2026 Patch Tuesday was the largest in the program’s history at 622 unique CVEs, including a record 416 affecting Windows alone. Three were zero-days: two under active exploitation and one publicly disclosed. For scale, the May release that prompted the original “record Patch Tuesday” headlines disclosed 30 critical CVEs. June set a new record; July nearly tripled it.

Two structural changes matter more than the raw number. First, Microsoft’s Security Update Guide no longer enumerates individual vulnerabilities, replacing the full listing with a summary table by product family and a short “Notable CVEs” section. When a vendor stops listing its own CVEs because there are too many to list, the disclosure model itself has broken. Second, Microsoft has told customers to expect elevated volumes permanently and has compressed recommended deployment deadlines to a window of roughly zero to three days.

Counting methodology now produces genuinely different headline figures for the same month. BleepingComputer counted 570 flaws by including only what Microsoft released on the day itself, excluding Azure OpenAI, Exchange Online, M365 Copilot and the 468 Chromium fixes Google shipped separately. Others reached 622 using Microsoft’s own totals. Neither is wrong. Anyone quoting a single figure without the methodology note is overstating what the data supports — the same trap that affects vulnerability counts across the industry.

Microsoft attributes much of the increase to MDASH, its multi-model agentic scanning harness, running against the Windows codebase. If you run Windows, this is why your update cadence changed; we covered the July 2026 Windows 11 update separately.

Why did the US government suspend Mythos and Fable 5?

This is the single largest development since May, and it needs to be described carefully because several of the underlying claims remain disputed.

The sequence is not in dispute. On June 9, 2026, Anthropic released Claude Fable 5 and Claude Mythos 5 — the same underlying model, with Fable 5 carrying stronger safeguards for general release and Mythos 5 restricted to Project Glasswing partners for defensive security work. Three days later, on June 12, Anthropic published a statement saying it had received an export control directive citing national security authorities, requiring it to suspend access by any foreign national inside or outside the United States, including its own foreign-national employees. Because nationality could not be verified in real time, the company disabled both models for everyone.

The trigger, per Anthropic’s own subsequent account, was a report from Amazon researchers describing a method of prompting Fable 5 so that it identified software vulnerabilities, and in one instance produced code demonstrating exploitation. Legal analysts described the order as an escalation in using export controls to restrict frontier model access, and as a precedent for direct government intervention in a commercially deployed AI product.

What is disputed is the severity and the handling. White House adviser David Sacks publicly stated that Anthropic had declined to remediate the issue; Anthropic disputed both the severity characterisation and the transparency of the process, noting the directive letter contained no specific detail of the concern. Reporting has attributed the initial escalation to Amazon leadership alerting officials. We have not seen documentation that settles the disagreement, and readers should treat both sides’ accounts as positions rather than findings.

The Commerce Department lifted the controls on June 30 and Fable 5 returned globally on July 1, initially with reduced usage allowances through July 7. Mythos 5 access was restored to some US organisations following government approval. The full episode ran 19 days. Our earlier coverage of the policy dimension is in our piece on the US AI export controls and the Anthropic suspension.

What did the export ban actually reveal about AI capability?

Something genuinely awkward for the original vulnpocalypse framing, and worth stating plainly.

In Anthropic’s account of the resolution, the company says its testing during the review confirmed that a number of less capable models — including Claude Opus 4.8, GPT-5.5 and Kimi K2.7 — could identify the same vulnerabilities cited in the Amazon report. This is the company’s own characterisation of its own testing, disclosed while arguing for restoration, and should be read with that context. But if it holds up, it undercuts the premise that gating one frontier model meaningfully gates the capability.

That reading is consistent with independent analysis from outside the labs. The Center for Strategic and International Studies has argued that the urgent problem is more mundane than autonomous superweapons — generative AI making existing attack methods faster, cheaper and more accessible. On that view the decisive variable is not who has the single most capable model but how cheap competent exploitation has become across the board.

There is a counter-argument worth weighing. Capability that is merely available is different from capability that is reliable and scalable, and a frontier model that automates the full chain end to end is a different operational proposition from one that requires expert steering. Both readings currently have evidence behind them. What the episode did demonstrate unambiguously is that model availability is now a policy variable, not just a commercial one — a dimension that also runs through the 2026 AI executive order on cybersecurity.

Are attackers actually using AI to find and exploit bugs yet?

Yes, and the evidence moved from prediction to documentation in May.

Google’s Threat Intelligence Group reported a case in which a threat actor used an AI model to discover a previously unknown authentication flaw and produce a working exploit, which GTIG assessed with high confidence had been generated without human authorship. Prior incidents had all involved AI assisting a human operator. GTIG has separately observed that adversaries are targeting the orchestration layers around models — wrapper libraries, API connectors, skill configuration files — rather than the models themselves, which have so far proved resilient to direct compromise. That is a meaningful distinction: the AI supply chain is currently the softer target, an issue we examine in our guide to agentic AI security risks.

The exploitation-speed data has moved too. Industry breach research for 2026 records roughly 28% of catalogued exploited vulnerabilities being weaponised within 24 hours of disclosure, and vulnerability exploitation overtaking credential theft as the leading initial-access vector for the first time in nearly two decades. Threat intelligence firms have started using the term autonomous vulnerability discovery and exploitation to describe systems that analyse a codebase, validate flaws and generate exploit code with limited human involvement — including by reverse-engineering a published patch to locate the flaw it fixes.

What has not happened is a mass-casualty event traceable to a frontier model. Three months into a three-to-five month window, the honest verdict is that the trend line is confirmed and the catastrophe is not. Anyone telling you either that nothing changed or that the collapse has arrived is ahead of the evidence.

Is the offense-defense gap narrowing at all?

Partially, and unevenly.

On the defensive side, vendor-side AI scanning is now normal practice rather than a pilot. Microsoft’s MDASH is in production. CISA has moved AI-enabled vulnerability detection into a production-grade test programme, though it has not published performance benchmarks or specified the techniques used. Both major labs have continued shipping capability into vetted-access channels rather than open release — OpenAI previewed GPT-5.6 Sol in late June under a formal two-tier trusted-access system, which we covered in our GPT-5.6 Sol breakdown, and Anthropic has continued Project Glasswing.

The gap that has not closed is remediation. Finding is automated; fixing is not. A 622-CVE month lands on the same understaffed teams, the same change-control processes, and the same testing and staging pipelines that existed when a heavy month meant 60 CVEs. Security analysts have framed the resulting problem as one of triage rather than volume: when everything is disclosed at once, prioritisation becomes the entire job.

There is also a new complication the May version could not have flagged. In July, CISA urged additional hardening for SharePoint servers amid active exploitation, and researchers disclosed one half of a chained remote code execution pair with the second half held back until August. Split disclosure across patch cycles is a rational defensive choice, but it means defenders are now working with deliberately incomplete information — another cost of compressed exploitation timelines.

What should you do about it now?

If you run security for an organisation: the actionable change since May is prioritisation infrastructure, not more scanning. Automated deduplication, exploitability context and asset-based ranking are what make a 600-CVE month survivable; a longer list of findings does not. Treat internet-facing assets as a separate and faster track, and assume disclosure-to-exploitation is measured in hours. Platforms like those in our Aikido vs Snyk comparison are a starting point, not a solution on their own.

If you write software: the same reasoning capability behind your AI coding assistant is being pointed at your output by other people. Security scanning in CI/CD has moved from best practice to baseline within a single quarter. Assume that shortcuts, hardcoded assumptions and trust boundaries that were never written down will be found.

If you are an individual user: the practical advice has not changed, and that is genuinely reassuring. Enable automatic updates on your operating system, browser and apps, and install them promptly rather than deferring. Use unique passwords with a reputable manager, and turn on two-factor authentication where it is offered. The accelerating patch cadence is the system working — the patches exist because the bugs were found by defenders first. If you want to check your exposure, our guide to checking whether your email was in a breach is a reasonable place to start, and AI browser safety is worth reading if you use one.

What to watch next: whether August’s Patch Tuesday sustains 600-plus, whether the withheld half of the SharePoint chain lands cleanly, whether Glasswing-style vetted access holds as models proliferate, and whether any further export-control action follows the June precedent. That last one is now the least predictable variable in the entire picture.

FAQ

What happened to Claude Mythos 5 and Fable 5?

Anthropic released both on June 9, 2026. On June 12 the US government issued an export control directive barring access by foreign nationals, and because nationality could not be verified in real time Anthropic disabled both models for all users. The Commerce Department lifted the controls on June 30 and Fable 5 returned globally on July 1, with Mythos 5 restored to some approved US organisations. The suspension lasted 19 days.

How many vulnerabilities did Microsoft patch in July 2026?

Reported figures range from 570 to 622 for the same release depending on methodology. The higher count uses Microsoft’s own totals; the lower excludes items shipped outside the main release, such as Azure OpenAI and Exchange Online fixes, and the 468 Chromium vulnerabilities patched separately by Google. Either way it was the largest Patch Tuesday on record, and Microsoft has stopped listing CVEs individually.

Are hackers using AI to find zero-day vulnerabilities?

Yes, though scale remains limited. Google’s Threat Intelligence Group reported a case it assessed with high confidence as an AI model independently discovering a flaw and generating a working exploit without human authorship — the first such case it has documented. More commonly, AI is accelerating existing attacker workflows rather than replacing them. No mass-scale incident traceable to a frontier model has been publicly documented as of late July 2026.

Did the three-to-five month warning window turn out to be accurate?

Partly. Roughly three months in, patch volumes have risen faster than predicted and the first AI-originated exploit has been documented, so the direction was right. But the anticipated wave of AI-driven attacks has not arrived at scale, and analysts including CSIS argue the realistic near-term impact is cheaper and faster conventional attacks rather than autonomous ones. Treat it as a trend confirmed, not a deadline met.

Does restricting frontier AI models actually reduce cyber risk?

It is contested. Anthropic stated that its testing during the June review found several less capable models, including Claude Opus 4.8, GPT-5.5 and Kimi K2.7, could identify the same vulnerabilities cited in the report that triggered the export order — a claim made by the company while seeking restoration. Others argue reliable end-to-end automation at frontier scale is a materially different risk from capability that merely exists. Both positions currently have supporting evidence.