Claude Mythos Preview is surfacing critical zero-days faster than any team can track where they live. VIM is the lineage layer that turns a single upstream finding into the full map of every fork, vendored copy, and compiled binary running the same vulnerable code.
The problem
Frontier models like Anthropic's Claude Mythos Preview have collapsed the cost of finding flaws. The bottleneck now is mapping where the vulnerable code actually lives. No existing tool answers the question: given a vulnerability in project X, which forks, vendored copies, and compiled binaries are also affected?
59.3%
of vulnerable copied files are C code — invisible to package-level SCA tools.
World of Code research, Mockus et al.
17%
of open-source components enter codebases outside package managers entirely.
Black Duck 2026 OSSRA
37 days
median patch-porting delay across hard forks — 25%+ take over 3 months.
Pan et al., ISSTA 2024
Regulatory deadline. EU Cyber Resilience Act takes effect 11 September 2026. Penalties up to €15M or 2.5% of global turnover for non-compliance — and it requires lineage evidence that current SCA tools cannot provide.
Anthropic's Claude Mythos Preview is, in its own words, "capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and every major web browser." In a single month it surfaced thousands of high- and critical-severity bugs — among them a 27-year-old flaw in OpenBSD and a 16-year-old vulnerability in FFmpeg.
This is a different kind of tool doing a different kind of work. And finding the bug faster isn't enough — the moment Mythos reports a flaw upstream, the urgent question becomes: where else does this exact code already live? That is the question VIM exists to answer.
Mythos · Project Glasswing
Finds the zero-day in upstream code.
VIM
Traces every fork, vendored copy, and modified variant carrying the same code.
GUAC · OSV · deps.dev
Maps affected artifacts and drives the fix downstream.
How it works
VIM identifies every code unit three ways at once. Combined, they survive renames, vendoring, forks, and non-trivial edits.
ECMA-427 package identity. Ecosystem-aware. Aligned with OSV, GUAC, and deps.dev.
pkg:npm/lodash@4.17.21
Software Heritage ID. Content-addressable. Identifies code by what it is, not what it's called.
swh:1:cnt:3b18e512...
Locality-sensitive hash. Survives patches and refactors. Similarity becomes a distance query.
5ca1d8a25f213672...
Prototype signal
Measured TLSH distance in our end-to-end test harness:
| Relationship | TLSH distance |
|---|---|
| Byte-identical | 0 |
| Single-site security patch | 48 |
| Unrelated code | 297 |
Runnable: go test ./pkg/identity/
Ecosystem
VIM is the lineage layer between upstream discovery and downstream remediation. It is built to interoperate with existing OpenSSF projects — not duplicate them.
| Existing tool | What it does | How VIM extends it |
|---|---|---|
| GUAC | Artifact composition | Adds fork lineage + code-level provenance |
| OSV | Vuln-to-version mapping | Traces vulns across forks and copies |
| deps.dev | Dependency resolution | Tracks vendored code outside dep trees |
| Scorecard | Security posture | Monitors patch propagation across forks |
| SLSA / Sigstore | Build integrity | Connects binary provenance to source lineage |
Data sources
Try the prototype
The trilateral identity layer and an in-memory inheritance graph are runnable right now — including ingesting a Mythos report and tracing a finding across a corpus of forks and copies. The persistent graph backend (JanusGraph + Cassandra) and GUAC integration land later in the roadmap.
# Clone and build git clone https://github.com/abduljaleel/vim.git cd vim go build -o bin/vim-cli ./cmd/vim-cli # Compute a LineageID for any file ./bin/vim-cli identity README.md 'pkg:github/abduljaleel/vim@pre-alpha' SWHID: swh:1:cnt:5049b7304c2b1037... pURL: pkg:github/abduljaleel/vim@pre-alpha TLSH: 5ca1d8a25f2136724b37cecb... # Compare two files by similarity ./bin/vim-cli similarity a.c b.c TLSH distance: 48 Result: MODERATE similarity (possibly related / patched variant) # Trace a Mythos finding across a corpus of forks & copies ./bin/vim-cli query examples/mythos/findings.json examples/mythos/corpus CONFIRMED · byte-identical copies of the vulnerable code (2): - upstream/parse.go - verbatim-fork/parse.go REVIEW · shares lineage, fix may or may not be applied (2): - patched-fork/parse.go TLSH distance 25 - cosmetic-fork/parse.go TLSH distance 26
Roadmap
OpenSSF Sandbox submission · Alpha-Omega & CRC-P grant applications · Community engagement at OpenSSF Community Day NA.
JanusGraph + Cassandra core · Software Heritage ingestion · Phase 1 GUAC integration · Mythos / Project Glasswing vulnerability report tie-in.
Alpha release at DEF CON 34 · EU CRA enforcement window outreach · OpenSSF Incubation application · Beta release with Phase 1 GUAC integration complete.
VIM is pre-launch. We are recruiting maintainers, research partners, and design-partner organisations with real supply chain compliance problems.