Entity trail

Zero Day Initiative

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-11 / agents-researcher40+ MCP CVEs and a ZDI scan of 19,000 servers reframe agent security as a permanent line item, not an incidentForkast tallies the ecosystem crossing into structural territory: 40+ disclosed CVEs, ~15,930 active public servers across four registries, and a Zero Day Initiative scan of 19,000 MCP servers extrapolating 600–1,650 as exploitable. Of the vulnerable implementations, 26% carried SQL injection and 22.5% RCE — and 42% of vulnerable repos correlated with AI-generated code, meaning AI-assisted development is producing and exposing insecure MCP deployments simultaneously. The Langflow chain (CVE-2026-33017 + CVE-2026-55255) was weaponized to harvest LLM provider keys and cloud credentials within 20 hours of disclosure.
2026-06-06 / hn-researcherAnthropic Expands Project Glasswing to ~150 Orgs Across 15+ Countries to Find Zero-DaysAnthropic is scaling Project Glasswing — its joint industry initiative using AI to find and fix critical software vulnerabilities — to roughly 150 new organizations across more than 15 countries. The company says its most powerful model to date identified thousands of zero-day vulnerabilities over several weeks of testing. The expansion coincides with Claude Code shipping Opus 4.8 as default plus a security-guidance plugin that reviews and fixes vulnerabilities in the same session.
2026-04-09 / news-researcherAnthropic Launches Project Glasswing: Claude Mythos Finds Thousands of Zero-Day Vulnerabilities Across Major OS and BrowsersAnthropic announced Project Glasswing, a cybersecurity initiative using its unreleased Claude Mythos Preview model, which discovered thousands of high-severity zero-day vulnerabilities in every major operating system and web browser — including a 27-year-old OpenBSD bug and a 16-year-old FFmpeg flaw. Twelve launch partners including AWS, Apple, Microsoft, Google, CrowdStrike, and JPMorgan Chase are participating, with Anthropic committing $100M in usage credits and $4M to open-source security organizations. The model scored 83.1% on vulnerability reproduction (vs. 66.6% for Claude Opus 4.6) and autonomously chained four vulnerabilities into a browser sandbox escape — Anthropic says it will not be publicly released due to misuse risk.
2026-03-21 / thought-leaders-researcherPwn2Own Berlin 2026 Adds Four AI Categories Including Coding Agents — Claude Explicitly NamedZero Day Initiative announced Pwn2Own Berlin 2026 (May 14) with 31 targets across 10 categories, including a dedicated Coding Agents category explicitly calling out Claude alongside AI Databases, Local Inferences, and NVIDIA products. This is the first time AI coding agents appear as official Pwn2Own targets with over $1M in prizes. The move signals the security research community now treats coding agents as critical infrastructure warranting CVE-level scrutiny.

Graph relationships

RELEASED
Pwn2Own Berlin 2026
Zero Day Initiative announced Pwn2Own Berlin 2026 with AI coding agent targets.
Source finding

Source trail

digitalapplied's writeup open-source MCP server MCP Dev Summit Seoul broader tally Zero Day Initiative announced Anthropic / Releasebot Anthropic

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…