Checkmarx Taps Claude Mythos 5 as 80% of Exploits Hit Day-Zero

For security teams, the J.P. Morgan statistic that 80% of exploitations occur on or before the day a vulnerability becomes public is a stark reminder that patch cycles are already too slow. Checkmarx's move to deploy Claude Mythos 5 inside Anthropic's Project Glasswing is an attempt to find latent codebase risk before it reaches the exploitation window.

On September 3, 2026, Checkmarx announced — in a press release carried by GlobeNewswire and syndicated through regional outlets — that it is joining Anthropic's Project Glasswing, an initiative that grants select security organizations access to Anthropic's Mythos environment for defensive cybersecurity work. The announcement is a claim by Checkmarx and has not been independently verified by the outlets carrying it; nevertheless it signals a convergence between application security and frontier AI. Checkmarx says it will use Claude Mythos 5, Anthropic's newest model, to strengthen its vulnerability detection capabilities and to share findings with the wider security community.

“

Checkmarx's move to deploy Claude Mythos 5 inside Anthropic's Project Glasswing is an attempt to find latent codebase risk before it reaches the exploitation window.

The context Checkmarx cites is one of accelerating exploitation timelines. It points to a July 2026 J.P. Morgan Eye on the Market analysis — titled 'Patchmageddon' — that found roughly 80% of exploitations now occur on or before the day a vulnerability becomes public. That statistic underscores the collapsing patching window: by the time an organization becomes aware of a CVE or security flaw, attackers may already be weaponizing it. Traditional application security tooling, which depends on signature updates, scheduled scans, and manual triage, is ill-suited to that tempo. Checkmarx argues that frontier AI models can now surface categories of risk that have sat latent in codebases for years, ahead of conventional scanning cycles.

If the company's claims hold, the Project Glasswing participation could reframe vulnerability management from reactive patching to proactive discovery of dormant risk classes. Checkmarx is not simply licensing an AI feature; it is embedding a frontier model into its research workflow and committing to share what it learns with the industry. CEO Sandeep Johri's statement — 'We've watched frontier models surface risk that's gone undetected for years, faster than most organizations can keep up' — frames the effort as both a product enhancement and an industry-wide public good. The company's Checkmarx Zero research arm provides the internal mechanism for pairing threat intelligence with product innovation.

For the security industry, this announcement represents one of the first concrete cases of a major application security vendor publicly hitching its R&D to a frontier model in a defensive capacity. Anthropic's Project Glasswing appears designed to test Mythos and Claude models in high-stakes, real-world settings while limiting access to select partners. The project's name evokes an observational layer, suggesting a controlled data-sharing environment. Checkmarx's participation may give Anthropic valuable feedback on model performance against live codebases, while Checkmarx gains a differentiated detection capability.

Still, significant caveats apply. The announcement is promotional and forward-looking: it describes intended use, not independently measured outcomes. There are no disclosed benchmarks, no peer-reviewed comparisons between Claude Mythos 5 and existing scanners, and no timeline for when industry-learned improvements will materialize. The 80% statistic from J.P. Morgan is a market research conclusion, not a peer-reviewed study, though it aligns with broader security narratives around zero-day and same-day exploitation. For security teams, the immediate impact is limited — Checkmarx has not shipped a product update as of this announcement, and Anthropic's Mythos access remains restricted.