Anthropic’s Mythos AI reports no further ‘serious’ bugs in Zcash: Wilcox

Zcash founder Zooko Wilcox says a security review of the privacy-focused protocol conducted using Anthropic’s Claude Mythos AI model did not uncover serious issues. The assessment was requested by Shielded Labs, a Swiss non-profit that supports Zcash development.

Wilcox shared the result in an X post on Saturday, adding that the audit found “no more serious bugs” in the Zcash protocol. The announcement follows earlier emergency steps taken by Zcash developers in early June after a vulnerability in the network’s shielded pool was identified and addressed.

Key takeaways

• Zooko Wilcox says Anthropic’s Claude Mythos security audit found no serious vulnerabilities in Zcash’s protocol after a Shielded Labs request.
• In early June, Zcash developers temporarily suspended Orchard shielded pool transactions, then restored functionality the same day via an emergency upgrade.
• The Orchard issue was linked to a four-year-old forgery bug, discovered with assistance from Anthropic’s Claude Opus 4.8 model and researcher Taylor Hornby.
• The Zcash Foundation stated there was no evidence of exploitation, no detected unauthorized value creation, and no impact on user privacy.
• Across crypto, the rapid rise of advanced AI security tooling is increasing both defensive capability and concern about who benefits from vulnerability-finding at scale.

Claude Mythos audit reports no serious Zcash protocol flaws

Wilcox’s update centers on an AI-assisted security audit carried out by Anthropic’s Claude Mythos model. According to his post, Shielded Labs—described as a Swiss-based non-profit supporting Zcash development—requested the review, which then concluded that there were no serious vulnerabilities in the Zcash protocol.

The timing of the claim matters for Zcash users watching for follow-up risk after an Orchard-related emergency earlier this month. While AI tooling can accelerate the discovery of potential issues, a “no serious vulnerabilities” outcome also signals that at least this specific protocol check did not reveal additional high-impact defects.

June Orchard disruption and the emergency upgrade

Before the Claude Mythos audit result, Zcash developers took more direct operational action on June 3. They temporarily suspended Orchard transactions after discovering a vulnerability inside the shielded pool that processes privacy-preserving transfers.

Functionality was restored later that same day through an emergency upgrade, indicating a rapid response once the risk was identified. The Zcash Foundation later characterized the situation as one without confirmed exploitation.

In its account of the incident, the Zcash Foundation said there was no evidence the vulnerability was exploited, that no unauthorized value creation was detected, and that user privacy remained unaffected. Those statements were made in connection with an emergency soft fork and related network activation details described by the foundation in its technical update.

What the Orchard vulnerability actually was

Based on the earlier reporting referenced in Wilcox’s broader context, the Orchard problem traced back to a forgery bug that had existed for four years. Security researcher Taylor Hornby is credited with discovering the issue with help from Anthropic’s Claude Opus 4.8 model.

This distinction is important for investors and builders because it frames the risk not as a newly introduced flaw, but as something that had been latent and only later surfaced through improved analysis. It also implies that even older vulnerabilities can re-emerge as new tooling and methods become available—particularly where complex cryptographic protocols are concerned.

AI security tools: faster discovery, heightened threat concerns

While Zcash’s development process appears to benefit from advanced AI assistance, the larger debate in crypto is whether the same tools can also be used to accelerate attacks. The industry has increasingly raised alarms that improved vulnerability discovery could shift advantage toward threat actors.

Anthropic released the first public version of Claude Mythos, and the company has previously said Mythos and related models uncovered more than 10,000 high or critical-severity vulnerabilities in “systemically important software.” That statement fueled scrutiny over whether such capabilities should be broadly accessible.

In response to concerns, Anthropic stated that its Fable 5 model was “made safe for general use” with safeguards designed to reroute certain topics—such as cybersecurity—toward a different model (Claude Opus 4.8). However, Anthropic also later said it suspended access to Fable 5 and Mythos 5 following a US government export control directive citing national security concerns.

From the perspective of crypto defense, this creates a complicated landscape: AI models may be able to identify vulnerabilities quickly, but access controls and evolving policy can change who can use that capability and for what purpose. The result is a growing asymmetry between attackers and defenders, especially in a market where fast-moving smart-contract ecosystems can become targets.

Bug bounty platform Immunefi CEO Mitchell Amador warned in an interview that the proliferation of these new AI tools is changing the cybersecurity playing field toward attackers, calling it a “vulnerability apocalypse.” He tied that dynamic to a resurgence in DeFi hacks. Separately, DefiLlama’s data shows crypto hacks reached $634 million in April—the highest monthly total since the Bybit incident that led to roughly $1.4 billion in losses in February 2025.

Why the Zcash audit matters now

Zcash’s latest update is not just about whether one vulnerability was found—it’s also about whether the privacy protocol has additional serious problems after a high-scrutiny period. The combination of a June Orchard emergency response and a later Claude Mythos audit outcome suggests the team is continuing to stress-test the system with modern security approaches.

Still, Zcash users should treat the audit result as one datapoint among many. The Claude Mythos review reportedly found no serious issues, but the broader crypto environment remains sensitive to rapidly evolving AI-assisted security research—meaning the key question going forward is not whether AI can find problems, but how quickly vulnerabilities (and any exploitation attempts) can be detected, patched, and validated across different platforms.

Readers should watch for whether Zcash developers share additional post-audit assurance steps, and whether the industry’s ongoing AI model access changes—driven by export controls and “safety” restrictions—shift the tempo of both defensive research and attack activity.