Security in the Post-Mythos Era: Defending at Machine Speed

By Taylor Thomas · 2026-08-31

For most of software security’s history, an assumption held quietly underneath much of defensive practice: finding a new vulnerability was expensive. It took rare skill and real time, so latent bugs sat unfound for years, and defenses were — implicitly — calibrated to that discovery rate. That assumption is starting to fail. Anthropic describes its Mythos-class frontier models as excelling at discovering software vulnerabilities, and restricts that capability to a small group of vetted cyberdefenders and infrastructure providers through Project Glasswing, with a broader trusted-access program announced to follow; the industry shorthand “post-Mythos” marks the moment the capability stopped being hypothetical. The demonstrations predate the name: Google reported that its Big Sleep agent found a previously unknown memory-safety bug in SQLite in 2024 — assessed by Google as exploitable, fixed before it reached an official release — and DARPA’s AI Cyber Challenge showed autonomous systems finding and patching vulnerabilities — most deliberately planted for the competition, some previously unknown real-world flaws — in challenge code built from widely used open-source projects. A defensible posture for this era rests on three pillars: harden, detect, validate.

Discovery Was a Scarce Resource

Be precise about what is changing, because it is not the attack categories — AI-assisted discovery does not inherently create a new vulnerability class, and exploitation still ends in familiar places — code execution, credential theft, movement, exfiltration, denial of service, plain disclosure. What is changing is the cost and parallelism of finding new vulnerabilities. Discovery was a scarce resource — one bottleneck among exploit development, access, and operationalization, but the one that made “no one has found it yet” a workable, if unspoken, security control. As discovery becomes cheaper and more parallel — and finding a flaw is still a step short of proving it exploitable — the time a latent bug can be expected to survive unfound shrinks, and every practice calibrated to the old rate — leisurely patch cycles, tolerated legacy exposure, the assumption that obscure internal software draws no attention — loses margin without anyone changing a setting. This is a different acceleration from the one covered in AI-accelerated attacks: that article is about executing known attack patterns with better economics; this one is about the supply of new vulnerabilities itself.

Harden: Shrink What a Machine Can Find

The first pillar is making the search space smaller before anyone searches it. Exposure reduction multiplies whatever patch speed you have: a service that is unreachable, or reachable only through an enforced boundary, faces fewer races when the boundary’s policy genuinely restricts who can reach it — permitted peers and management paths still can — so exploitation likelihood can shrink and risk-based priority may follow, while the remediation obligation remains. Aggressive attack-surface review — every internet-facing service justified or removed, every unchanged default credential and unjustified permissive configuration treated as the finding it is — pays off doubly, because many configuration weaknesses are amenable to automated discovery. Patch prioritization sharpens rather than relaxes: internet-facing and high-privilege systems get the fast pipeline because likelihood and impact concentrate there; for what cannot move fast, compensating controls — IPS coverage, segmentation that actually enforces, least privilege — are monitored, temporary buys of the time the patch cycle needs.

Detect: Assume the Novel Exploit

The second pillar accepts that some vulnerabilities will be found first by someone else. A signature specific to a not-yet-characterized vulnerability generally will not exist — but an intrusion is more than its entry hole, and campaigns that go past a one-shot disclosure commonly leave observable effects, if the telemetry is collected: processes behaving out of character, connection paths that never existed before, authentications off their baseline. That is why detection weight shifts toward behavioral and telemetry-based methods — flow analysis, endpoint behavior, the anomaly-oriented direction intrusion prevention is already moving — which add coverage exactly where per-vulnerability signatures do not yet exist, while existing signatures keep earning their place against known tooling, generic exploit techniques, and the layered detections both guidance and practice call for. Not every exploit grants that visibility — a pure information disclosure may never produce a second act — which is why assume-breach stops being a slogan and becomes the design constraint.

Validate: Turn the Capability Around

The third pillar is the direct answer: the capability that threatens your code can audit it first. AI-assisted review and fuzzing belong in the development pipeline, finding real flaws before deployment does — with findings and any generated fixes validated, regression testing included, before anyone trusts them. On the operations side, continuous validation of the live attack surface — what is actually reachable, what an authenticated foothold can actually do — makes annual-only penetration testing insufficient as the sole assurance mechanism, though periodic scoped human testing keeps finding what automation misses. Frontier-model access programs for security capability are explicitly aimed at defenders, and defenders hold one advantage attackers often lack at the outset: internal context — inventory, dependencies, effective policy — real exactly to the degree it is maintained, protected, and fed to the tools. A machine-speed search of your systems, run by you, with your context, is the one the attacker’s version has to beat.

The SCOR 350-701 v2.0 blueprint frames the era from both directions: objective 1.1 lists AI among the attack threats environments face, objective 1.3 covers vulnerabilities in AI and LLM systems themselves, and objective 6.6 covers the defensive telemetry and AI/ML tooling. The SCOR course teaches the underlying controls hands-on — because the pillars are only as strong as the engineer who builds them.

Frequently Asked Questions

Is AI actually finding real vulnerabilities, or is this still hypothetical?

It is documented. Google reported in 2024 that its Big Sleep agent found a previously unknown memory-safety bug in SQLite that Google assessed as exploitable, fixed before it shipped in an official release. DARPA's AI Cyber Challenge had competing systems find and patch vulnerabilities — most deliberately planted, some previously unknown real-world flaws — in challenge code built from widely used open-source projects, under competition conditions. And Anthropic describes its Mythos-class frontier models as excelling at vulnerability discovery — capability it restricts to vetted defenders. The open questions are diffusion speed and generality, not existence.

Does machine-speed discovery mean patching is hopeless?

No — it means the priorities sharpen. Internet-facing and high-privilege systems need a fast, honest patch pipeline because likelihood and impact concentrate there. Exposure reduction works alongside patching, not instead of it: a service that is unreachable, or reachable only through a boundary whose policy genuinely restricts sources and flows, faces fewer races and a smaller blast radius when it loses one — though permitted peers, management paths, and compromised internal hosts still reach it, so remediation stays on the books. Compensating controls — IPS coverage, segmentation, least privilege — are temporary, monitored buys of time on the systems that cannot move fast, not substitutes for remediation.

Can defenders use the same discovery capability?

Yes, and it is the most direct answer available. The same class of capability that threatens your code can audit it first — AI-assisted review and fuzzing in the development pipeline, with findings validated by humans before they are trusted, and continuous validation of the deployed attack surface making annual-only testing insufficient as the sole assurance. Access programs for frontier-model security capability are explicitly aimed at defenders, and accurate internal context — inventory, dependencies, effective policy — is an advantage attackers often lack at the outset — insiders and established footholds excepted — where it is actually maintained and protected.