Anthropic's Claude Mythos has autonomously found thousands of critical vulnerabilities across every major operating system and browser, generating working exploits without human guidance. The Cloud Security Alliance's emergency briefing makes clear this is not a temporary spike — it is a structural shift in how attack and defence work. Here is what it means for public sector and critical infrastructure organisations.
The Moment the Industry Had Been Warned About
In April 2026, Anthropic announced Claude Mythos Preview alongside Project Glasswing, and the Cloud Security Alliance published an emergency strategy briefing signed by some of the most credible names in the industry — including the former Director of CISA, the former National Cyber Director of the White House, the CISO of Google, the former Cybersecurity Director of NSA, and the founder of the UK National Cyber Security Centre. That list alone tells you something about how seriously this development is being taken.
The briefing describes what Mythos actually did: it autonomously found thousands of critical vulnerabilities across every major operating system and browser. It generated working exploits without human guidance. In internal testing at Anthropic, Mythos produced 181 working exploits on Firefox where the previous model succeeded only twice under identical conditions. It found a 27-year-old bug in OpenBSD. It did all of this at a speed and scale that outpaces any prior capability — and it did it without elaborate scaffolding or configuration. A single prompt. No specialist operator required.
This is the moment the security community had been tracking toward for over a year. What changed is that it arrived.
The Asymmetry That Cannot Be Reasoned Away
The structural problem Mythos creates is not the model itself. It is what the model reveals about the underlying asymmetry between attackers and defenders — and how that asymmetry is now accelerating.
AI lowers the cost and skill floor for finding vulnerabilities faster than organisations can patch them. Tracking of zero-day exploit timelines puts a number on this: time to exploitation has collapsed to under one day. Not one week. Not one month. One day. The window between a vulnerability being discovered and being weaponised has effectively closed for the most capable adversaries, and Mythos-class capabilities will spread — to open-weight models within six to twelve months, to threat actor tooling shortly after.
Patching, as a primary defensive strategy, cannot keep pace. This is the most uncomfortable implication of the CSA briefing. Current patch cycles, response processes, and risk metrics were built for an environment where organisations had weeks between vulnerability disclosure and active exploitation. That environment no longer exists. Defenders bear the inherent cost of patching — the testing, the change management, the operational disruption — while attackers simply move to the next target. When AI can discover and weaponise vulnerabilities faster than human patch cycles can respond, the defender's position deteriorates regardless of how diligent the patching programme is.
Attackers gain disproportionate benefit. This is the phrase the CSA briefing uses, and it is the honest way to describe it. Mythos and its successors help attackers find and exploit weaknesses. They also help defenders find and fix weaknesses. But the economics are different: an attacker needs to succeed once, can operate at machine speed across thousands of targets simultaneously, and does not carry the operational burden of change management. The defender needs to succeed everywhere, all the time, and must carry that burden. AI accelerates both sides, but it accelerates the offensive side more.
What Project Glasswing Tells Us About the Limits of Coordinated Disclosure
Anthropic responded to Mythos's capabilities by creating Project Glasswing, which the CSA briefing describes as possibly the largest multi-party vulnerability coordination effort in history. Selected critical infrastructure providers, industry partners, and open source maintainers were given early access to Mythos so they could patch their own products before public disclosure. Other AI vendors have launched similar programmes.
This is genuinely important work. It represents a serious attempt to use AI capabilities for defensive benefit before offensive actors can exploit the same discoveries. The coordinated disclosure model, when it works, gives defenders a meaningful head start.
But the CSA briefing is honest about Glasswing's limitations. The world's exploitable attack surface is vastly larger than any curated partner ecosystem can cover. Most organisations that build or maintain critical software will not have early access to Mythos-class capabilities. And the competitive landscape is narrowing: if comparable offensive capabilities emerge in open-weight models within six months to a year — which the briefing judges likely — the defensive advantage conferred by early access becomes time-limited by definition.
The conclusion the briefing draws is not that Glasswing is insufficient. It is that no coordination programme, however well-designed, substitutes for organisations building the internal architecture to contain the impact of vulnerabilities that will inevitably be found and exploited.
What This Means for Healthcare, Government and Essential Services
Organisations in healthcare, local government, central government, and critical national infrastructure face this shift with specific characteristics that make the CSA briefing's recommendations particularly relevant.
Patch cycles in these environments are longer, not shorter. Clinical systems, operational technology, legacy infrastructure, and complex vendor dependencies mean that the standard advice of "patch faster" runs directly into operational reality. A hospital cannot take a clinical information system offline for emergency patching on a two-hour notice. A water utility cannot apply untested patches to operational control systems without validation cycles. These constraints are real. They do not disappear because the threat environment has changed. What they mean is that containment architecture — the ability to limit the blast radius when something does get exploited — becomes even more critical than in environments with faster patch cadence.
The attack surface in these sectors is heterogeneous and partly opaque. NHS trusts, local authorities, and CNI operators typically manage a mix of modern managed infrastructure, legacy systems maintained by third-party vendors, operational technology that predates modern security concepts, and interconnected partner environments. Mythos-class vulnerability discovery does not distinguish between well-maintained codebases and those that have not been touched in a decade. If anything, it is more likely to find exploitable vulnerabilities in the latter.
The consequences of exploitation in these sectors are qualitatively different. A ransomware incident in a hospital is not simply a business disruption — it is a patient safety event. A compromise of water treatment control systems is not a data breach — it is a public safety emergency. The CSA briefing's language around resilience and containment architecture is particularly relevant here, because the acceptable blast radius is smaller, not larger.
Two Different Vulnerability Landscapes — Only One Gets a CVE
One of the most important distinctions to draw in responding to the Mythos announcement is the difference between what AI vulnerability discovery tools like Mythos actually surface, and the full landscape of weaknesses that put organisations at risk.
Mythos and its successors are exceptional at finding a specific category of vulnerability: software flaws, hardware and firmware weaknesses, and network or product-specific bugs that have a discrete technical root cause — a buffer overflow, a memory corruption issue, a logic error in a VPN implementation. These are the vulnerabilities that receive CVE numbers, that appear in the CISA Known Exploited Vulnerabilities catalogue, and that drive patch advisories from vendors. The spike the CSA briefing describes — thousands of new disclosures, collapsing time to exploitation — is concentrated in this category.
| Vulnerability category | Gets a CVE? | Found by Mythos-class tools? |
|---|---|---|
| Software flaws | Yes | Yes |
| Hardware and firmware weaknesses | Yes | Yes |
| Network and product-specific bugs | Yes | Yes |
| Misconfiguration (open ports, default credentials, cloud exposure) | No | No |
| Identity and access weaknesses (overprivilege, flat AD, poor IAM) | No | No |
| Architectural design weaknesses (flat networks, absent segmentation) | No | No |
| Human and social vulnerabilities | No | No |
| Process and procedural gaps | No | No |
| Supply chain risks | No | No |
Not all vulnerabilities get a CVE. The AI-driven spike hits the top three rows. The resilience programme addresses all nine.
The rows in that table that do not get CVE numbers are not less dangerous — they are often more so. Misconfiguration (open ports, default credentials, cloud exposure), identity and access weaknesses (overprivilege, flat Active Directory, poor IAM), architectural design weaknesses (flat networks, absent segmentation), human and social vulnerabilities, process and procedural gaps, and supply chain risks: none of these produce a CVE. None of them will be discovered by Mythos and disclosed through Project Glasswing. None of them will appear in a patching advisory. They are invisible to the CVE and KEV feeds entirely, yet they are the weaknesses that ransomware operators and nation-state actors most reliably exploit to convert a foothold into a catastrophic incident.
This distinction matters enormously for how organisations respond. A CISO who responds to the Mythos announcement purely by accelerating their patching programme is addressing the right problem in an incomplete way. The CVE spike is real and demands faster patch cycles and better vulnerability management tooling. But if the organisation still has Domain Admins logging into workstations, flat network segments without meaningful east-west controls, default credentials on network devices, and no Identity and Access Management governance, then patching faster does not materially change the blast radius when an attacker does get in.
The resilience programme — building AD tiering to best practice, implementing effective vulnerability management processes, enforcing segmentation, hardening identity — is the programme that addresses the full table, not just the top three rows. It is the architecture that limits what an attacker can do with the CVE-discovered vulnerability they just exploited in under a day. CIS Controls and NCSC guidance are explicit about this: the frameworks cover all nine vulnerability categories precisely because the threat does not confine itself to what the CVE database tracks.
The practical implication is that organisations facing resource constraints need to sequence intelligently. Getting AD tiering right — specifically ensuring Domain Admin credentials cannot be harvested from compromised workstations — does more to limit the consequence of a successful CVE exploitation than any amount of patch acceleration, because it breaks the lateral movement chain that converts an endpoint compromise into a domain-wide ransomware event. Effective vulnerability management processes, including prioritisation by exploitability and business impact rather than raw CVSS score, ensure that the CVE spike does not simply overwhelm the team with undifferentiated volume. These are the controls that make the Mythos-driven risk landscape navigable.
The Basics Become More Important, Not Less
The CSA briefing's tactical recommendations for the immediate term are strikingly similar to the security fundamentals that have always mattered. This is not an accident. When the threat environment accelerates, the value of solid foundational controls increases — because they are what limit the consequence of the exploitation that cannot be prevented.
Segmentation, egress filtering, Zero Trust architecture, and phishing-resistant MFA are the controls the briefing specifically calls out. These are not new recommendations. They are the controls that contain the blast radius when a vulnerability is exploited before a patch is available — which, in a world where time to exploitation has collapsed to under a day, is the scenario organisations must plan for rather than treat as an edge case.
Identity control remains the central leverage point. If Mythos-class tools are used to find a vulnerability in an internet-facing system, and that system is properly segmented from the internal network, and lateral movement requires valid credentials that are properly tiered and controlled, the attacker's ability to convert that initial foothold into domain-wide impact is substantially constrained. The vulnerability exists. The exploit works. But the architecture limits what it can reach.
Asset inventory and crown jewel identification — knowing what systems you actually have, what they depend on, and which of them matter most — become more important when the speed of incoming vulnerabilities increases. You cannot prioritise what you cannot see.
Defenders Can Use These Tools Too
The CSA briefing makes a point that is easy to miss in the urgency of the threat discussion: the same AI capabilities that are accelerating offensive activity are available to defenders, and in the domain of vulnerability discovery and code review, they are already mature.
Using an AI agent to perform security review of code is not a theoretical future capability. It is available now, and the briefing argues it represents one of the most accessible immediate actions a security team can take. Beyond vulnerability discovery, AI agents can accelerate incident response, automate GRC activity, support red team exercises, and enable the kind of continuous security assessment that would previously have required dedicated specialist resource.
The briefing's framing of this is worth taking seriously: every security role is becoming an AI builder role, and the barrier to entry is lower than most people assume. The organisations that adapt their teams to use these tools will be better positioned to close the gap the briefing describes. Those that treat AI capability as something that belongs only to the attacker side of the equation will find that gap widening.
The Human Cost Cannot Be an Afterthought
One section of the CSA briefing that deserves particular attention is its treatment of the human cost of this transition. Security teams are being asked to absorb exponential increases in workload — more vulnerabilities to triage, more patches to test and deploy, more incidents to respond to — without corresponding increases in headcount, tooling, or operational support. The briefing is direct: burnout and attrition in security functions represent a direct operational risk.
This is especially relevant for public sector organisations, where security teams are often already stretched, where budget cycles do not move at the speed the threat environment requires, and where the competition for experienced security professionals is intense. The expertise needed to navigate this transition is scarce, takes years to develop, and is not replaceable on short timescales.
The recommendation to plan for additional headcount and reserve capacity is not a nice-to-have. In the context of a sustained increase in vulnerability volume, it is as operational a requirement as any technical control.
What a Mythos-Ready Programme Looks Like
The CSA briefing's definition of being Mythos-ready is not about responding to one model or one announcement. It is about building the architecture that positions an organisation to respond to this wave and the waves that will follow.
Resilient architecture that limits blast radius. Segmentation, Zero Trust, tiered identity, minimal lateral movement paths. The controls that mean a compromised endpoint or a successfully exploited vulnerability does not become a domain-wide incident.
Proactive vulnerability discovery. Using AI tooling to find weaknesses in your own environment before adversaries do. This requires knowing what you have, which requires an accurate and current asset inventory.
Incident response capability at scale. Updated playbooks, pre-authorised containment actions, tabletop exercises that run scenarios involving multiple simultaneous high-severity incidents. Not because that has always been the norm — it has not — but because it increasingly will be.
AI-augmented security operations. Agents that help the human team operate at the speed the environment now requires, rather than expecting the human team to absorb the volume increase alone.
The Y2K comparison the briefing makes is instructive. Y2K was a systemic threat with a hard deadline, and the industry met it through coordinated, disciplined effort. The AI vulnerability storm does not have a single deadline — it has a trajectory. The organisations that treat it as a programme rather than an incident will be better positioned than those waiting for a moment of clarity that may not come.
This post draws on the Cloud Security Alliance emergency briefing "The AI Vulnerability Storm: Building a Mythos-ready Security Program" (April 2026), authored by the CSA CISO Community, SANS, OWASP Gen AI Security Project, and contributors including Jen Easterly, Bruce Schneier, Chris Inglis, Rob Joyce, and Heather Adkins. The full paper is available at labs.cloudsecurityalliance.org.
