AI Is Finding 3.5x More High-Severity CVEs Than Ever Before: What That Means for Your AI Proxy Posture

On Friday, Epoch AI published the security industry's most consequential data point of 2026: high- and critical-severity CVE disclosures jumped 3.5x in June 2026 versus the pre-Mythos monthly record. The driver is AI-powered vulnerability discovery, specifically Anthropic's Claude Mythos Preview and the Project Glasswing coordinated-disclosure partnership. OpenAI's parallel Daybreak program is finding the same volume on a different cohort. The backdrop: 10,000+ high/critical vulnerabilities identified since Glasswing commenced, with the rate accelerating monthly.

For Trimio customers running their AI workloads through a proxy, the implication is structural: the attack surface underneath your LLM gateway is now larger than it's ever been. The CVE volume is no longer measured in the dozens per month — it's measured in the thousands. The question facing every enterprise security team today isn't "are we exposed?" but "can our AI infrastructure tell us how exposed in real time?"

The numbers

From Epoch AI's analysis:

• Pre-Mythos baseline: ~430 high/critical CVEs/month (the historical norm.
• June 2026 actual: ~1,500 high/critical CVEs in a single month — a 3.5x multiplier.
• Project Glasswing cumulative: 10,000+ high/critical vulnerabilities since launch in partnership with Microsoft, Google, Apple, and AWS.
• OpenAI Daybreak parallel: independent offensive research running on GPT-class models produces comparable volume.

Why this matters now: the rate of disclosure is still accelerating. Epoch projects Q3 disclosures will continue to compound — Glasswing's research pipeline is running, the offensive capability of Mythos-class models is improving week-over-week, and OpenAI's parallel Daybreak program runs on a different cohort with similar yield.

Two stories running on the same week

The Epoch AI data point lands 4 days after the Anthropic steganography disclosure and the subsequent Alibaba Claude Code ban. The two stories look unrelated — one is about finding bugs in vendor software, the other is about a vendor secretly modifying client behavior.

But they share the same question for your security team: "What is your AI infrastructure doing that isn't in the documentation?"

• Story 1 (steganography): Claude Code v2.1.91–v2.1.196 silently inserted Unicode markers in system prompts when routed through a custom `ANTHROPIC_BASE_URL`. Removed in v2.1.197 with no changelog entry. Reuters confirmed Alibaba is banning Claude Code effective July 10 over backdoor-risk concerns.
• Story 2 (Glasswing): Anthropic's Mythos is now finding vulnerabilities in software at a 3.5x rate vs the baseline. The disclosure pipeline partnership with Microsoft, Google, Apple, and AWS spans enterprise-critical dependencies.

From a security reviewer's perspective, the combined posture reads as: Anthropic is simultaneously building the strongest offensive capability in the industry and shipping client-side behavioral modifications without disclosure. The proxy layer — any AI gateway, Trimio's included — is the natural governance surface because it's the layer that sees every byte of every request and response, regardless of vendor behavior.

Why the proxy layer is suddenly the security layer

Three structural shifts explain why the proxy layer is becoming the security layer for AI workloads:

1. CVEs targeting AI-loaded dependencies land at the proxy

The Trimio proxy sits in front of every model call. If a CVE lands in a library on the request path — HTTP serialization, JSON parser, TLS handshake, prompt-template engine — the proxy is the blast radius. The proxy must:

• Detect dependency vulnerabilities on the request path in real time.
• Surface them to the operations dashboard with the affected endpoint flagged.
• Maintain rotation/replacement readiness for any library component behind the egress seam.

With the CVE rate at 3.5x baseline, "detect on next manual scan" cadence isn't adequate. The proxy now needs CVE-feed consumption as a first-class operational concern.

2. Provider behavior modifications are proxy-observable

Claude Code v2.1.91–v2.1.196 inserted steganographic markers in the system prompt content — the very text the proxy forwards. The proxy is the only layer that intercepts this stream before it reaches the model API. Detection queries on system prompt content (Unicode apostrophe substitution patterns, timezone-gated date separator effects) are proxy-layer concerns by construction.

This is the same reason the proxy layer is the right place to detect any model-side behavioral modification: adversarial decoupling, prompt-template injection, model-side context growth without user awareness, classification markers — all proxy-observable, none application-observable.

3. SOC 2 observation windows now overlap the CVE spike

For Trimio specifically: SOC 2 Type I observation window opens July 17, 2026 — 13 days from now. The window will capture dependency CVE exposure at a higher baseline than any prior SOC 2 cycle. Audit reviewers will ask:

• How does Trimio detect and patch CVEs in the request-path dependency chain?
• What is the rotation cadence for secrets, keys, and credentials behind the egress seam?
• How are provider behavior modifications audited and disclosed to customers?

These are questions Trimio's proxy layer is positioned to answer — and the answers matter for both compliance and customer trust.

The SOC 2 angle

Most enterprises approaching SOC 2 in 2026 haven't yet updated their AI infrastructure controls for the new baseline. The controls that matter:

• Vulnerability disclosure ingestion — proxy consumes the GitHub Advisory DB and the Anthropic/Glasswing feed simultaneously.
• Provider behavior audit log — every system prompt passed through the proxy is retained for forensic review.
• Per-customer forensic reporting — when a vendor ships an undisclosed behavior change, the proxy can answer "what was in your traffic last week" within hours, not weeks.
• Key rotation and access review — the egress seam credentials that let Trimio call Anthropic, OpenAI, or GLM-5.2 providers must rotate on a documented cadence; access reviews must show who has what scope.
• Training attestation — for AI providers that ingest customer traffic into model training (or claim they don't), the proxy log is the verification artifact.

Trimio is positioned to deliver all five — with the CVE spike as the forcing function to prioritize the controls enterprise SOC 2 reviewers will test.

What separates "AI infrastructure" from "AI procurement risk"

Trimio customers with active proxy deployments now have access to several artifacts that didn't exist in 2025:

• Per-call vendor attribution — every LLM call in the bill is traceable to a specific provider, model, and timestamp.
• System prompt archival — the exact text sent to the model on every turn is retained for forensic review.
• Response-side metadata — usage tokens, finish reasons, model-version headers — captured for downstream audit.

This is the data substrate that turns "we use Claude Code" into "we audited our Claude Code traffic between April 2 and July 2 and have a written report." That second sentence is the one enterprise procurement teams will demand after the Alibaba ban lands on July 10 — and it's the second sentence AI-native security teams should be writing today.

The two stories converge at the proxy

The convergence is the part that matters:

• CVE spike forces a vendor-side supply-chain audit that the proxy needs to perform.
• Steganography disclosure forces a customer-side traffic audit that only the proxy can answer.
• Alibaba ban on July 10 forces every enterprise with Chinese-market exposure to ask both questions, on the same week.
• SOC 2 observation on July 17 makes the answers to both questions a compliance artifact, not a commercial differentiator.

Enterprises who positioned their AI layer with proxy-side forensic capability before this week have a distinct advantage. Enterprises who didn't are now retrofitting under deadline pressure. The leading indicator is the same in both cases: can you answer "what was in our AI traffic last week?" within 24 hours?

The 90-day checklist

If you're an engineering, security, or procurement lead using AI infrastructure today, the 90-day control checklist:

1. Audit AI provider behavior on the request path — instrument the proxy to detect documented vs undocumented behavioral changes per vendor SDK version.
2. Ingest CVE feeds on the request path — every component between the application and the model API needs continuous CVE monitoring at the 3.5x disclosure rate.
3. Archive system prompts — every system prompt sent through the proxy needs to be retained for the SOC 2 observation window plus 12 months.
4. Run per-vendor forensic queries on demand — when a vendor ships a security event, the proxy must answer "what was in your traffic" within hours.
5. Document the proxy as the AI governance surface — internal SOC 2 reviewers, external auditors, and customer procurement teams all need the same answer: "we have a proxy, here's what it logs, here's the controls."

The Epoch AI 3.5x number is the data point that converts these controls from "nice to have" to "Q3 compliance requirement." Most enterprises will hit the SOC 2 observation window without them. The Trimio proxy is built to deliver them as standard features.

Trimio is the LLM API gateway that delivers AI cost governance and security governance in one layer — per-call vendor attribution, system-prompt archival, dependency CVE feed consumption, and on-demand per-customer forensic reporting. See how it works.