Post-Mythos Security: When Exploits Outpace the Patch Cycle 

Security teams have always lived with more vulnerabilities than they could fix. That is not new. 

What is new is the speed at which AI can discover, test and help weaponize those vulnerabilities. Frontier cyber models such as Mythos mark a shift in attacker economics. The limiting factor is no longer only expertise. It is orchestration. 

A model can review code at a scale no human team can match. It can map how distributed services talk to each other. It can repeat tasks without fatigue. It can test paths, adjust payloads and learn from the results. Work that once took a specialist days can start to look like an overnight batch job. 

That changes the math for defenders. 

The old model assumed that discovery was hard, exploitation took time and human capacity limited the pace of attack. AI weakens each of those assumptions. Discovery scales. Weaponization accelerates. Attackers can test more ideas, throw away what fails and move to the next path faster than before. 

The result is a new security reality: the bottleneck moves from finding issues to deciding what actually matters. I presented on this topic in a recent webinar that you can access here From AI Hype to AI Risk: A New Security Reality.  

Discovery is cheap 

Vulnerability management has spent years improving asset inventories, scanning and severity scoring. Those still matter. You cannot defend what you cannot see. 

But AI pushes discovery into a different category. 

In the webinar, I described the shift this way: large and distributed codebases used to create heavy lifting for human reviewers. Modern environments are not one clean monolith. They are scattered services, asynchronous workflows, APIs, libraries and dependencies. Understanding which code talks to which service is hard work. 

For AI, that work is well suited to automation. 

This is why Mythos is important. The model is not only summarizing security findings or helping an analyst write a query. It represents a broader move from AI as an assistant to AI as an operator. It can reason, use tools, retry and pivot. It can work toward an objective. 

That does not make AI magic. It does make scale cheaper. 

Anthropic’s Glasswing research, as cited in the webinar deck, estimated 23,019 findings across more than 1,000 open-source projects, including 6,202 high or critical issues and 181 working exploits. One now-patched OpenBSD vulnerability was 27 years old. 

Those numbers matter because they show the shape of the problem. AI will keep surfacing old bugs, hidden bugs and reachable bugs faster than human triage queues can drain them. 

Weaponization is speeding up too 

Finding a bug is one step. Turning it into a working exploit is another. 

Historically, that second step required time, skill and patience. An attacker needed to test hypotheses, try payloads, understand failure modes and refine the approach. That work still requires judgment. But AI can reduce the cost of experimentation. 

Think of it as smarter fuzzing. An attacker can generate many candidate approaches, let them run, inspect the results and iterate. The machine does not get tired. It does not mind retrying. It does not need to wait for the next working day. 

That means defenders should expect more attempts, more variation and more speed. 

This is not only a vulnerability research problem. It also affects malware development, obfuscation, defense evasion and tool creation. The deck cites Anthropic research on AI-enabled cyber threats across 832 banned accounts from March 2025 to March 2026. The observed misuse included activity across 14 MITRE ATT&CK tactics and 482 unique sub-techniques. 

The point is not that AI makes every attacker elite. 

The point is that AI broadens capability before it perfects autonomy. It helps more actors do more work, faster. 

Scanning still matters. It just no longer sets priority. 

A natural response is to ask whether vulnerability scanning still matters. It does. 

Stopping scanning would be the wrong lesson. Security teams still need asset inventory, vulnerability visibility and exposure data. The issue is that scanning alone no longer tells leaders where money and people should go first. 

A scanner can tell you what exists. It cannot fully answer whether a threat is relevant to your organization, whether the issue is achievable in your environment or whether exploitation would affect a service, identity or dataset the business cares about. 

Those are the questions that should set priority. 

Security leaders need to move from “what is severe?” to “what can an attacker actually achieve here?” 

That requires three harder answers: 

1. Is it relevant? Is anyone using this technique against environments like ours? Does the threat profile match our industry, geography, technology stack or business model? 
2. Is it achievable? Can this be exploited in our environment, through the controls we actually run? Is there a reachable path or does a compensating control change the outcome? 
3. Does it matter?  If the attack lands, does it affect a critical service, privileged identity, regulated dataset or board-level obligation? 

Severity scores alone cannot answer these questions. They were never designed to carry that much weight. 

The real constraint is defensive capacity 

AI creates more findings. It also creates more noise. 

The scarce resource is not the ability to list exposures. It is the capacity to validate, prioritize and prove which exposures can lead to harm. That is the work security teams must protect. 

If defenders try to respond to AI-scale discovery with manual triage alone, they will lose time. They will spend too many cycles on theoretical risk and too few on proven exposure. They will patch what looks urgent while attackers test what is achievable. 

The better operating model is evidence-led. 

Start with the threats that matter. Emulate the behavior. Validate whether prevention and detection hold. Prioritize by achieved impact and control gaps. Then adapt the environment and prove the fix worked. 

This is where AI helps defenders too. The same class of technology that gives attackers speed can help security teams run a faster loop. AI can help map relevant threats, generate tests, interpret results, recommend prioritization and support control tuning. People still need to govern the process. But the machine can carry much of the repetition. 

What security leaders should change now

The first change is reporting. 

Boards and executives do not need a longer list of vulnerabilities. They need to know whether the organization is reducing plausible attack outcomes. 

That means reporting on exposure retired, paths closed, controls improved and time reduced. It means connecting security work to the systems and identities that matter most. It means showing evidence that harm was likely, achievable and consequential before asking for resources. 

The second change is prioritization. 

Teams should budget around what an attacker can actually achieve, not what a scanner can list. A high-severity vulnerability on an unreachable system may matter less than a moderate issue on a critical path with weak controls. Context is no longer a nice addition. It is the decision layer. 

The third change is speed. 

If attackers are using AI to accelerate discovery and exploitation, defenders need AI to accelerate validation and response. The goal is not to replace the security team. The goal is to remove the manual drag between signal and action. 

Closing 

Mythos is a warning, but it is also a lesson. 

The warning is that vulnerability discovery and exploit development are becoming faster, cheaper and more scalable. 

The lesson is that more scanning is not enough. 

Security leaders need to know which threats are relevant, which paths are achievable and which outcomes matter to the business. That requires proof. It requires prioritization. It requires a faster defensive loop. 

The organizations that adapt first will not be the ones with the longest vulnerability lists. They will be the ones that can prove what matters, act on it and prove again that the risk went down. 

To learn more, check out the full webinar From AI Hype to AI Risk: A New Security Reality.