For 30 years, finding a serious flaw in software was slow, skilled work, and fixing it was the easy part. Frontier AI has reversed that. Here is what changed, what CrowdStrike and its partners have built in response, and what it means for any organization that runs its own code.
In April 2026, Anthropic described a vulnerability its unreleased Claude Mythos model had found in OpenBSD, an operating system with a reputation for being one of the most carefully audited pieces of software in existence. The flaw let an attacker crash any OpenBSD machine remotely just by connecting to it. It had been sitting there for 27 years (PCWorld, April 8, 2026). Nobody had found it. Not the maintainers, not the researchers, not the many red teams that had been through the code.
That single bug is a useful way to understand what has happened to software security this year, because it is not really a story about one flaw. It is a story about who finds flaws, how fast, and at what cost.
What Changed
Until very recently, the discovery of serious vulnerabilities was limited by human attention. Scanners caught known patterns. Skilled people caught logic errors, design flaws, and the kind of subtle interaction between components that only appears when someone reads the code the way an attacker would. That skill was scarce, so discovery was slow, and the slowness was a form of protection. Most organizations could patch faster than attackers could find things worth exploiting.
Frontier AI models read code the way the skilled people did, but at machine scale. When Anthropic gave Mythos to roughly 50 partners under Project Glasswing, those partners collectively found more than 10,000 high- or critical-severity vulnerabilities in their own software in the first month. Cloudflare alone reported 2,000 bugs, 400 of them high or critical, with a false-positive rate its team judged better than human testers (Anthropic, May 22, 2026). CrowdStrike ran the same model against 43 open-source products and surfaced more than 2,400 vulnerabilities, 26% of them high or critical, and about half of the confirmed findings came with a working proof-of-concept exploit (CrowdStrike, July 20, 2026).
Read those numbers as a defender and the implication is uncomfortable. The code your business runs on almost certainly contains flaws of this kind. They have always been there. What is new is that finding them is no longer expensive, and the people who can afford frontier models include adversaries.
Why the Window Matters
The time between a vulnerability becoming known and an attacker using it was already collapsing before any of this. Mandiant tracked the average time-to-exploit falling from 63 days in 2018 to 2019, to 32 days in 2021 to 2022, to five days in 2023 (Google Cloud, October 15, 2024). CrowdStrike’s 2026 Global Threat Report found that 42% of vulnerabilities exploited in 2025 were used as zero-days, before any public disclosure, and that the average eCrime breakout time, the gap between an intruder’s initial access and their first lateral movement, fell to 29 minutes, with the fastest observed case at 27 seconds (CrowdStrike, February 24, 2026).
Meanwhile the other side of the ledger is moving the wrong way. Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities was the initial access method in 31% of breaches, now the leading cause ahead of phishing and stolen credentials. The share of organizations fully remediating the vulnerabilities on CISA’s Known Exploited Vulnerabilities list fell from 38% to 26% in a year, and the median time from detection to full remediation rose from 32 days to 43 (Verizon DBIR 2026, as reported by SC Media, May 20, 2026).
So the finding is getting faster and cheaper while the fixing is getting slower. That is the problem Project QuiltWorks exists to solve, and it is worth being precise about it. The problem is not that organizations lack scanners. The problem is capacity: the ability to take a flood of findings, work out which ones an attacker would reach for, and close them before they become a problem.
What Project QuiltWorks Is
CrowdStrike launched Project QuiltWorks on April 23, 2026 as an industry coalition rather than a product, and the structure tells you what it is for. CrowdStrike contributes discovery and prioritization: frontier models from OpenAI and Anthropic (NVIDIA’s open Nemotron models have since been added) scanning code, with the Falcon platform’s adversary intelligence used to rank findings by whether they are exploitable, whether adversaries are active against them, and what they would cost the business. Services partners contribute the remediation capacity, which is to say the people who assess an organization’s readiness, fix the code, and translate the results into something a board can act on (CrowdStrike, April 23, 2026).
The launch coalition was built around the largest systems integrators. In September, CrowdStrike extended it with a North American partner cohort for United States and Canadian customers, spanning assessment, architecture, engineering, offensive security, managed detection and response, security operations, and remediation (CrowdStrike, September 10, 2026). That expansion is what makes QuiltWorks relevant to a 2,000-person insurer or airline rather than only to a global bank with an Accenture contract.
Two named components give it a shape a customer can buy. The Frontier AI Readiness and Resilience Service (FAIRR) is the subscription that packages the scanning, the expert prioritization, and the guided remediation, with reporting written for the board. Falcon IQ is the assessment layer that turns findings into attack narratives, investment priorities, and a remediation roadmap.
What It Means for You
If your organization writes and runs its own software, the honest position is that frontier AI can now find flaws in it that nobody has found before, and that capability is spreading. Anthropic has said it does not plan to make Mythos generally available, but its stated goal is to let users deploy Mythos-class models at scale eventually (PCWorld, April 8, 2026). The direction is not in doubt.
QuiltWorks is the first serious attempt to give organizations below the very largest the same discovery capability, pointed at their own code first, with the human expertise to act on what it finds. CrowdStrike’s George Kurtz described the aim as giving every organization the answer their board needs. For a security leader, that is the point. The question your board is going to ask is whether you are exposed. QuiltWorks is built to let you answer it with evidence.
Access runs through the partner cohort. NETbuilder is one of an exclusive group of partners selected for that role, offering a route in for a broader range of organizations.
Learn More
Want to know whether your software is exposed? For more information, or to arrange a free consultation, contact the NETbuilder team.
Next in this series: FAIRR, and what the board gets from it.
