When Anthropic introduced Claude Mythos Preview, the cybersecurity debate quickly turned to what AI could do: uncover decades-old vulnerabilities, develop working exploits and accelerate tasks that once required specialist expertise. Anthropic noted that Mythos discovered software flaws no human had caught, and early tests showed it could carry out multi-stage network attacks in minutes — tasks that once took skilled pen testers days.
Security leaders and cyber defenders let out an initial sigh of relief when it was announced that Mythos would be available to a select few, with an extension to 150 other organizations.
The Mythos moment and hype have now passed, and the harder task is turning its warning into practical defensive readiness. The initial shock is over. Now comes the hard part: can organizations identify their exposures, prioritize real risks and patch or mitigate them fast enough to stay ahead of AI-powered attacks? Can they be as fast as AI in even discovering them to begin with?
AI-Accelerated Attacks Are Already Here to Stay
There is no hiding from it now — AI-enabled and accelerated attacks are here already, and they are already rewriting cyber-attack playbooks worldwide. In 2026, Stanford’s AI Index reports that AI agents now solve cybersecurity problems 93% of the time, up from just 15% in 2024. Independent tests confirm this trend: the UK’s AI Security Institute (AISI) found Claude Mythos Preview could autonomously execute a 32-step simulated corporate network attack — a scenario that humans would take approximately 20 hours to complete — and retrieve flags hidden on target machines. In short, frontier AI models can chain together reconnaissance, exploitation and privilege escalation without human help. In these trials, Mythos reliably discovered and exploited vulnerabilities autonomously, tasks that would take human professionals days of work.
Allied research backs this up. A Cloud Security Alliance report notes that attackers now operate at machine speed, whereas defenders still often operate on “organizational speed.” In practice, this means patch cycles of weeks or months no longer keep pace with exploit windows measured in hours. Widely deployed software — operating systems, browsers, network devices — precisely the high-impact targets many enterprises depend on, are now rapidly weaponized. Email is also not spared, as attackers have stepped up their use of AI-enabled prompt injection phishing attacks to deceive employees into wiring money to fake accounts.
Vulnerabilities and Exploits Are Exploding in Growth
Data shows this isn’t a theoretical worry: the volume of known flaws and their exploitation is surging. Google’s Threat Intelligence group found that reported vulnerabilities doubled from January to July 2026, rising from approximately 5,000 to over 10,000 per month. At the same time, the number of those vulnerabilities actually exploited in the wild nearly doubled, from an average of approximately 10.5 per month in 2025 to approximately 18 per month in early 2026. Even zero-day exploits ticked up slightly.
Google and others warn that this trend will continue. If rapid AI-assisted discovery and exploitation keep accelerating, defenders cannot afford unprioritized mass-patching as in the past. Instead, they must move to a threat-intelligence-driven triage model: focus on the vulnerabilities actually being targeted, and automate as much response as possible. This means continuous scanning, asset inventory and risk-based prioritization — often called exposure management — using tools like Wiz, Tenable and Microsoft Defender for Cloud. Security Boulevard explains that an exposure management program uses AI to constantly map assets, vulnerabilities and misconfigurations, then automatically prioritize and remediate the riskiest ones. This approach is essentially a “Mythos-ready” security program — one designed to handle the avalanche of findings that AI will generate, and to fix them at machine speed. AI, essentially battling AI.
Using AI Defensively
Defenders can use AI as well as attackers, so it benefits both sides. Anthropic’s own Project Glasswing is a case in point. In early April 2026, only approximately 50 organizations were testing Mythos Preview, but within weeks they had already run it across their codebases and uncovered over 10,000 high- or critical-severity flaws. Anthropic is now expanding Glasswing to approximately 150 additional organizations deemed critical — power, healthcare, communications and others — whose code impacts millions of users. The aim is to train industry on new AI-powered workflows: partners share best practices, triage vulnerabilities together and even use AI to suggest fixes and pre-emptively harden code.
Glasswing’s lessons show that AI can speed up defensive tasks too. Mythos-level models can be repurposed to write patches or convert legacy code into memory-safe languages, and to run AI red teams against one’s own systems. Anthropic reports that partners are now using Mythos to automatically generate fixes, and their new public tool, Claude Security, helps scan code and suggest patches using a slightly safer variant of Mythos. In practice, organizations should consider adding AI to their security toolchain and leverage automated penetration testing, intelligent asset discovery and tagging, and AI-assisted patch generation to help keep pace with attackers.
Reinforce the Fundamentals
Even as organizations deploy sophisticated tools, the basics still matter more than ever. AISI emphasizes that Mythos’s impact actually highlights the importance of cybersecurity basics — regular patching, strong access controls, secure configurations and comprehensive logging, consistent with standards like the UK’s Cyber Essentials.
If attackers can automate exploits, defenders must double down on hygiene and detection. With exploit windows collapsing to hours, organizations may need to accelerate patch cycles through more frequent updates, rolling hotfixes, or virtual patching via network controls when immediate fixes aren’t available.
Least privilege and segmentation must also be in place to reduce each user or system’s access to only what it needs. An attacker — or malicious AI agent — with stolen credentials should find it hard to move laterally or escalate privileges. Network segmentation and micro-segmentation can slow or isolate attacks even after they penetrate the perimeter. Incident response playbooks should be updated to account for fast, AI-enabled attacks. Test scenarios where key accounts or credentials are compromised, and ensure break-glass administrative accounts or recovery keys are secured — offline if possible — so teams can regain control even if the primary identity provider or domain is down.
Building resilience means blending new AI-driven practices with solid engineering. As Anthropic warns, Mythos-class capabilities are coming to more organizations soon and with fewer safeguards than the preview carried. Security teams must adapt now by working at machine speed: automate exposure discovery and patching, enforce strict access controls, and enhance detection and response. Only by assuming that some attacks will succeed can organizations design defenses that contain the damage.
The Mythos moment — when powerful AI grabbed headlines — has passed. What matters now is translating its warning into practical readiness. The AI genie is out of the bottle, and cyber attackers will leverage these tools at the same time defenders do. Organizations that build machine-speed defenses today will be far better positioned to withstand what comes next.
