The Intake
The Intake — Thursday, October 15, 2026
On the substrate
Anthropic's Mythos model identified vulnerability volume at Bank of America requiring 1,000 contractors to patch
Anthropic Research The Register
If you've been evaluating AI-assisted vulnerability scanning for your own codebase, the Bank of America disclosure names the constraint the vendor pitch doesn't show: the model can find more than a team can patch.
Anthropic launched an opt-in vulnerability-finding service for open-source projects on October 8. The service, called the OSS Scanner, runs on Claude Mythos 5.1. In six months of operation, Anthropic says the scanner surfaced over 29,000 candidate vulnerabilities. The projects covered include PostgreSQL, OpenSSL, wolfSSL, HotCRP, and curl. Anthropic reviewed 97 critical and high-severity findings. Eighty-eight percent met coordinated vulnerability disclosure standards.
Bank of America CEO Brian Moynihan addressed the bank's experience on the company's Q3 2026 earnings call on October 14. Moynihan said the bank brought in 1,000 outside contractors to patch vulnerabilities Mythos identified. The contractors arrived in Q2 and remained at the bank as of the earnings date.
If you're planning to run AI-assisted scanning at any production scale, the Bank of America contractor count is the data point on what the human remediation side of that output can require.
---
For operators
Next.js 15 and 16 ship out-of-band patch for two critical unauthenticated RCEs
GitHub Security Advisories — vercel/next.js The Hacker News
If you're running Next.js in any production deployment — agent frontends, API gateways, or tool endpoints — two critical unauthenticated RCE flaws were patched on October 14. The patch came as an out-of-band release. The fixed versions are 16.4.1 and 15.5.28.
GHSA-673q-mjm6-r5xr affects use cache functions that return typed arrays. It carries a CVSS 9.5 score. The affected range is Next.js 16.0.0 through 16.4.0. GHSA-2464-fhr4-w9xw affects the Image Optimization API's librsvg-based SVG processing on glibc Linux systems. It is also CVSS 9.5 (CVE-2026-96889). That flaw spans versions 10.0.0 through 16.4.0. A third flaw, GHSA-p3m5-59mp-jv5r, affects Server Actions. It is a high-severity denial-of-service affecting versions 13.0.0 through 16.4.0.
No active exploitation had been reported as of October 15. If you're on any affected version, the path is to upgrade to 16.4.1 or 15.5.28 and rebuild your deployment.
---