AI Cybersecurity Moves From Mythos Shock to Exposure Management
The significance of Claude Mythos Preview isn’t simply that an AI model can find vulnerabilities. It’s that discovery, exploitation and movement through a network can now happen faster than many organizations can assess and fix the weaknesses they already have. The practical test for security leaders is whether their defenses can keep pace.
Anthropic said Mythos identified software flaws that people had missed. In early tests, it also carried out multi-stage network attacks in minutes, work that could take skilled penetration testers days. Access to the preview has been limited: after an initial group of around 50 organizations, Anthropic began expanding its Project Glasswing program to roughly 150 more. That restriction may have softened the immediate concern for some defenders, but it doesn’t resolve the operational problem the model exposed.
Teams need to know which assets are exposed, which flaws attackers are pursuing, and how quickly they can patch or contain them. Those questions have become more pressing as AI tools make it easier to link reconnaissance, exploitation and privilege escalation into a single sequence.
Attack speed is changing the response window
AI-assisted attacks are already influencing security work beyond Mythos. Stanford’s 2026 AI Index reports that AI agents solve cybersecurity problems 93% of the time, compared with 15% in 2024. In a separate evaluation, the UK’s AI Security Institute found that Mythos Preview completed a 32-step simulated attack on a corporate network and retrieved flags from target machines. The scenario would take a human about 20 hours to complete.
These results point to a shift in how attacks can be assembled. A model that can move through several stages autonomously reduces the amount of specialist time needed to act on a vulnerability. That matters because many organizations still handle software updates through approval and deployment cycles measured in weeks or months.
A Cloud Security Alliance report describes the mismatch as attackers operating at machine speed while defenders remain bound to “organizational speed.” When exploit windows shrink to hours, a monthly patch cycle leaves a long period in which a known weakness may remain usable. Operating systems, browsers and network devices are especially consequential because so many organizations depend on them.
Email remains part of the problem, too. Attackers are using AI-enabled prompt injection phishing attacks to deceive employees into sending money to fraudulent accounts. The pressure on security teams therefore spans both infrastructure vulnerabilities and techniques aimed at people.
More findings demand better prioritization
The number of reported vulnerabilities and the number exploited in real attacks are both rising. Google’s Threat Intelligence group found that monthly vulnerability reports doubled between January and July 2026, from about 5,000 to more than 10,000. Its figures also show the average number of vulnerabilities exploited in the wild increasing from roughly 10.5 per month in 2025 to about 18 per month in early 2026. Zero-day exploitation rose slightly as well.
A bigger queue of findings doesn’t automatically produce better security. If teams treat every issue as equally urgent, limited engineering time gets spread too thin. The response needs to connect vulnerability data to active threats and to the assets an organization actually operates. That means maintaining an accurate inventory, scanning continuously, and ranking exposures by evidence of exploitation and potential impact.
This is the logic behind exposure management approaches described by vendors including Wiz, Tenable and Microsoft Defender for Cloud. The goal is to map assets, vulnerabilities and misconfigurations, then direct remediation toward the risks that matter most. Security Boulevard’s explanation of exposure management describes using AI to support that ongoing mapping and prioritization.
For security teams, the useful measure is not how many findings a tool produces. It’s whether the organization can identify the important ones and reduce exposure before attackers act. Automation can help with scanning, triage and remediation, but it needs reliable asset data and a process that can move approved fixes into production.
Defenders can apply AI to the same work
AI can accelerate defensive tasks as well as offensive ones. Anthropic’s Project Glasswing offers an early example: the initial participants ran Mythos across their codebases and reported finding more than 10,000 high- or critical-severity flaws within weeks. Anthropic has said it is extending the program to around 150 additional organizations in critical sectors, including power, healthcare and communications.
The program is intended to help organizations develop new workflows for reviewing code, sorting findings and producing fixes. Participants can share practices and use AI to help assess vulnerabilities and harden software. Anthropic also says partners are using Mythos to generate patches. Its Claude Security tool scans code and suggests fixes using a variant of Mythos.
These uses could shorten parts of the defensive workflow: locating weaknesses, testing code changes and proposing remediations. AI-assisted penetration testing and asset discovery may also help teams examine systems more frequently. The payoff depends on what happens after a model identifies a flaw. Organizations still need engineers to validate fixes, understand dependencies and deploy changes safely.
Basic controls limit the damage
More capable tools don’t make established security practices less relevant. The UK’s AI Security Institute says Mythos’s capabilities underline the value of regular patching, strong access controls, secure configurations and comprehensive logging—the same foundations reflected in Cyber Essentials.
When a fix can’t be deployed immediately, teams can consider measures such as rolling hotfixes or virtual patching through network controls. Access should follow least privilege, so that a compromised account or system has as little reach as possible. Network segmentation can also limit lateral movement and help contain an intrusion after an attacker gets inside.
Incident response plans need to account for attacks that unfold quickly. Rehearsals should test scenarios involving compromised credentials and key accounts, including whether teams can recover control if their main identity provider or domain is unavailable. Securely maintained emergency administrative accounts and recovery keys can provide a route back in; offline storage may help protect them from the same incident.
Readiness is an operating discipline
Mythos Preview has made the pace of AI-assisted vulnerability research harder to dismiss. Anthropic has warned that similar capabilities may reach more organizations, potentially with fewer safeguards than the preview. The article also raises the possibility that comparable systems could become available to attackers, though it offers no certainty about when or how that might happen.
The response is an operating model that joins faster discovery with disciplined triage, patching and containment. Security teams should automate repeatable work, keep asset records current, tighten access and test how they respond when an attack succeeds. AI may increase the volume and speed of threats, but organizations can use it to shorten their own response loops. The practical advantage will go to teams that can turn a finding into a verified fix before it becomes an incident.
