Mythos finds.
Moderne fixes.
Every repo, at once.
Anthropic's Mythos surfaces vulnerabilities at AI scale. A coding agent equipped with Moderne closes every one with a deterministic recipe that runs across every repository in your code estate at once, with a full audit trail behind it.
▸ Find once. Fix once. Distribute everywhere.
Mythos surfaces a defect.
Agent writes a deterministic recipe.
One recipe, every repository.
Scanning is solved. Remediation is not. Mythos collapsed the runway between discovery and disclosure. The fix is the part that never scaled.
The remediation gap
Found faster than fixed.
A decade of scanner investment has not produced fix capacity, and neither manual triage nor probabilistic agent fixes can close findings at AI scale. The bottleneck is no longer discovery; it is deterministic, auditable remediation across thousands of repositories.
The attacker only needs to find one instance of a vulnerability. The defender has to close every instance, in every repository that pulls the affected dependency, before the business is no longer exposed.
Why doing nothing fails
Six pressures every CISO is facing at once.
Mythos did not change any of these in isolation. It compressed the timeline on all of them at once. Each one is a reason that the next disclosure cannot be answered the way the last one was.
The downstream CVE flood
Every Mythos-discovered flaw in a kernel, browser engine, or shared OSS library becomes a published CVE that lands in your scanner queue. The backlog multiplies by orders of magnitude before you act on any of it.
Probabilistic fixes don't close findings
LLM-based remediation produces partial fixes. The agent declares victory; the human re-prompts it all evening trying to confirm coverage. A vulnerability fix has to be complete to count.
Agents need a deterministic blueprint
The attacker finds one instance. The defender has to close every instance, or the business stays exposed. Without a recipe, there is no way to confirm every occurrence has been closed.
Token economics break at scale
Fixing one CVE across two thousand repositories by running fresh inference against each one means paying to rediscover the same fix two thousand times. Recipe-based remediation amortizes the work once.
You can't upgrade your way out
For end-of-life frameworks like older Spring, "just upgrade" is a multi-quarter migration. Mythos does not grant the runway. Backpatching the fix into the version you're running may be the only path that fits the window.
Board-ready answers, in hours
CISOs will be asked "what is our exposure to the latest Mythos disclosure?" within hours of each release. Without a deterministic remediation pipeline with an audit trail, the honest answer is "we don't know."
The architecture
Every red team needs a blue team.
Two halves of the same problem, solved by structure rather than competition. Mythos finds a vulnerability. The coding agent equipped with Moderne writes the recipe to close it. The Moderne Platform defends the perimeter, distributing that recipe across every repository in your code estate, in parallel.
Mythos
Anthropic's agentic discovery model
Finds vulnerabilities at AI scale. Nearly 300 zero-days in Firefox in a single sweep, versus roughly 20 from prior Claude models. Anthropic describes tens of thousands of vulnerabilities across software, most still undisclosed because they remain unpatched.
Equip Your Agent with Moderne
Any coding agent. Via MCP.
Connect the coding agent your team already runs to Moderne over MCP. With LST-based tools in hand, the agent both authors and executes a deterministic recipe to close the vulnerability. Agent-agnostic by design.
The Moderne Platform
Distributes the recipe across the code estate
The same fix runs identically across every repository in your portfolio, in parallel, with full audit trail. The board-ready answer to "what is our exposure" is a query against the same pipeline that did the remediation.
Mythos finds. Moderne fixes. Every repo, at once.
How Moderne works
How the agent gets a deterministic blueprint.
The Lossless Semantic Tree is the source of the determinism: the foundation that makes every capability below it reliable enough to put a board behind. From there, six capabilities turn one finding into one recipe, and one recipe into a fix across the entire portfolio.
-
01
The Lossless Semantic Tree
A type-attributed, semantically complete representation of source code. Supports interprocedural, field-sensitive analysis and follows method summaries across files. Without the LST, an agent's fix is a probabilistic guess. With it, the agent has a verifiable blueprint to execute.
-
02
OpenRewrite recipes
In an IDE, you trust rename and extract-method refactorings because they are deterministic. OpenRewrite takes that determinism out of the editor and makes it programmatic. Each recipe is a small, verifiable program that produces the same change every time it runs, against any repository in your portfolio.
-
03
Agent Tools and MCP
Connect any coding agent (Copilot, Cursor, Windsurf, Devin, Codex, Claude Code) to Moderne via MCP. With LST-based tools in hand, the agent both authors and executes deterministic recipes. Agent-agnostic by design.
-
04
Portfolio-scale distribution
One recipe runs across thousands of repositories in parallel. The unit economics of fixing one CVE across 2,000 repos should not be 2,000× the cost of fixing one. With Moderne, they aren't.
-
05
Backpatching
For end-of-life frameworks you can't upgrade fast enough, Moderne backports the security fix to the version you're running and distributes it, with no forced migration and no lost runway.
-
06
Audit and determinism by default
Every recipe run is deterministic and produces a verifiable record of what changed, where, and why. The board-ready answer to "what is our exposure" is a query against the same pipeline that did the remediation.
▸ Recipe authored by the coding agent, run against the LST.
What Moderne closes
The vulnerability classes Moderne remediates.
Two buckets, depending on where the vulnerability lives: different remediation paths, but the same deterministic recipe model underneath.
Third-party code
Code you depend on
-
Dependency vulnerability remediation.
Upgrade to a fixed version across every repository that pulls the vulnerable package. The same upgrade, applied identically, portfolio-wide.
-
Backpatches for end-of-life frameworks.
When upgrade isn't an option, backport the fix to the version you're running and distribute it across the frameworks you can't move off yet.
First-party code
Code you write
-
OWASP Top 10 remediations.
Injection, broken access control, cryptographic failures, and the rest of the canonical web vulnerability classes. Closed across every repository where the pattern appears.
-
Data flow and control flow remediations.
Taint-flow patterns that cross method boundaries, follow object fields, and propagate through wrappers. Closed deterministically against the LST.
-
Post-Quantum Cryptography migration.
Find and replace deprecated cryptographic patterns ahead of the PQC deadline. One recipe, every repository.
▸ Out of scope: the network edge, secrets management, infrastructure misconfiguration. Different problems, different tools.
You need something scalable, deterministic, and explainable. That's the only way to make progress across an estate this large.
Engineering Director · Large bank (anonymized)Proof is in production
The recipes are running today.
Real CVE remediation, real recipe code, and real customer deployments, not slideware.
CVE-2026-22732: every way a Spring controller commits a response too early.
Jonathan Schneider's detection-and-remediation recipe runs to twelve source files, 39 unit tests, and roughly 800 lines, with zero new framework code, and he built it in an afternoon. It catches five code patterns that pattern matching misses: direct flush, print-writer, explicit Content-Length, helper indirection, and field stashing.
Read the walkthrough →Tier-one bank: closed-loop with GitHub Copilot and Moderne MCP.
Scanner output flows through MCP to a Moderne recipe to a distributed fix, with the coding agent as executor, identifying and applying CWE remediation recipes against the scanner output they already have. In the customer's own framing, deterministic recipes beat probabilistic agent fixes.
Major insurance carrier: bridging the EOL Spring gap.
An end-of-life Spring framework had become a board-level concern for the CISO. With 200+ repositories already converted to Moderne and roughly 2,000 applications still in the migration pipeline, the customer asked Moderne for a backpatch directly, to bridge the gap while the larger migration runs in parallel.
Frequently asked
Common questions about Mythos and Moderne.
No. The agent stays. Moderne equips it with deterministic tools over MCP, so the same agent both authors and executes a recipe instead of guessing at a fix. Copilot, Cursor, Windsurf, Devin, Codex, Claude Code, and Gemma all reach the same tools the same way.
No. Moderne is the structural counterpart to Mythos by design, not by contract. Mythos finds. A coding agent equipped with Moderne fixes. The Moderne Platform defends the perimeter across the code estate. The architecture works whether your discovery engine is Mythos, an internal scanner, an SCA tool, or an ASPM feed.
The catalog spans Java, Kotlin, Groovy, Python, C#, JavaScript, TypeScript, and more across 10+ languages and 40+ domains. New recipes are added continuously; the agent can also author new recipes against the LST when one doesn't exist.
A recipe is a small, verifiable program that runs against the LST and produces the same change every time it runs, against any repository. An LLM-generated patch is a probabilistic output that varies between runs and across repositories. Closing every instance of a vulnerability needs the first, not the second.
It is a type-attributed, semantically complete representation of source code. Vulnerabilities that cross method boundaries, follow object fields, or pass through wrappers and helpers are followed by the LST instead of missed by it. Pattern matching alone misses indirect cases; the LST does not.
Yes. For end-of-life frameworks where upgrading is a multi-quarter project, Moderne backports the security fix to the version you're running and distributes it across the portfolio, with no forced migration and no lost runway.
Every recipe run produces a verifiable record of what changed, where, and why. The board-ready answer to "what is our exposure to the latest Mythos disclosure" is a query against the same pipeline that did the remediation.
Yes. Moderne DX is the airgapped deployment for regulated and sensitive environments. The platform, recipes, agent tools, and LSTs all run inside your network with no outbound dependency.
See it work against your stack
See Moderne close a CVE across your portfolio.
See the closed-loop architecture working against your own stack: recipe-based remediation across thousands of repos, in a concrete pipeline you can deploy this quarter.