Today in AI — 25 May 2026

Anthropic's Claude Mythos found over 10,000 high- or critical-severity vulnerabilities across 50 organisations in its first month. Google confirmed hackers used an AI model to build a zero-day exploit. And deleted Google API keys stay active for 23 minutes after deletion. The through-line today: AI is accelerating both sides of the security problem, and the defence is losing ground.

Security's new clock speed

AI-powered offence is outrunning AI-powered defence. Anthropic's Project Glasswing update reports the patching bottleneck has shifted from finding bugs to fixing them, while the average time to remediate a known high-severity CVE now sits at 74 days. Attackers, meanwhile, are exploiting disclosed flaws within 36 hours of publication. Google's own Cloud COO argues security cannot be bolted on after the fact, yet Aikido's research shows the company's own API keys remain active for up to 23 minutes after deletion.

• Anthropic's Mythos finds over 10,000 critical vulnerabilities in one month — and the patches can't keep up — Anthropic
• Google confirms hackers used AI to build a zero-day 2FA bypass — SecurityWeek
• Everyone is navigating AI security in real time — even Google — TechCrunch
• Deleted Google API keys keep working for 23 minutes, researchers find — Google says it won't fix it — Aikido Security
• The AI arms race in cybersecurity is tilting toward attackers — Security Affairs

The institutions respond

The Pope published an encyclical on AI. A top law school banned it from graded work. These are institutions that move slowly, and both moved this week. Pope Leo XIV's Magnifica Humanitas was presented alongside Anthropic co-founder Chris Olah, while UC Berkeley Law prohibited students from using generative AI to brainstorm, draft, or revise submissions from summer 2026 onward.

• Pope Leo XIV publishes first encyclical on AI, presented alongside Anthropic co-founder — NPR
• UC Berkeley Law bans AI for nearly all graded student work starting this summer — The Decoder

Anthropic's widening footprint

Mythos moves closer to a public release after the 10,000-bug milestone, and a $200 million partnership with the Gates Foundation puts Claude into global health and education work spanning polio, HPV, and eclampsia research. The company is placing bets across security, philanthropy, and consumer access simultaneously.

• Anthropic moves closer to public Claude Mythos release after 10,000-bug milestone — TechTimes
• Anthropic and Gates Foundation launch $200 million partnership for AI in global health and education — Anthropic

AI meets commerce and culture

Traffic to US retail sites from AI services grew 393% year-over-year in Q1 2026. Amazon's $49.99 Bee wearable records and summarises your conversations throughout the day. Ferrari and IBM are using watsonx to personalise the F1 fan experience. AI is no longer a back-office tool; it is the interface layer.

• AI is changing the internet forever — here's how — CNN
• I tried Amazon's Bee wearable and am both intrigued and slightly creeped out — TechCrunch
• Ferrari is using IBM's AI to turn weekend race watchers into F1 superfans — TechCrunch

Capital and capability

Cerebras raised $5.55 billion at $185 per share, with stock soaring 68% on day one. Separately, a research team used Claude Code to autonomously discover a test-time scaling algorithm that beats hand-written methods while using roughly 70% fewer tokens, with the entire discovery run costing about $40.

• Cerebras stock soars 68% in biggest tech IPO of 2026 — Morningstar
• Researchers let Claude Code discover AI scaling algorithms that humans probably wouldn't have designed — The Decoder

If you are building on AI infrastructure, the security gap between discovery and remediation is now the thing most likely to bite you before any competitor does.

---