What the AI patch gap means for enterprise security

**AI-driven discovery outpaces patching for open-source software:** Over ~nine weeks, Anthropic’s Claude Mythos and triage partners verified 1,596 vulnerabilities across hundreds of OSS projects with a reported true-positive rate around 90.8%. Discovery ran at ~25 verified findings/day while visible repairs occurred at ~1.5/day (roughly a 16.5:1 gap), producing a growing "vulnerability deficit." Maintainers typically acknowledge reports quickly but only ~6% had upstream patches at snapshot; the estimated span from disclosure to enterprise deployment is 3–5 months. Tuskira proposes triage-driven patching decisions (emergency, staged, deferred) and highlights that AI-driven discovery, propagation to downstream packages, and delays in advisories and scanner updates increase exposure risk for defenders.