The accelerating technological reality
The world is changing. Moore’s law and its effects on society place a continuously increasing burden on humans to keep up[1],[2]. Businesses are periodically confronted with new potential to increase productivity and competitive pressure to adopt new technologies. Technologists are constantly re-educating and recertifying themselves to empower organizations to reap new benefits. Risk and security personnel are constantly confronted with little known and poorly understood changes to risk landscapes. Regulators are always behind in recognizing potential societal threats that require new legislation to avoid societal disaster. This was the case for the rise of the computer, the internet, the cloud, big data, distributed ledger technology, and now for AI.
We are currently on the dawn of the AI revolution. Already the availability of AI functionality is rapidly changing the way we work, communicate, make decisions, the nature of our IT infrastructures, and our legislative and risk landscapes. The complexity and potential of AI make it hard to predict where we will be tomorrow, how our lives will change, and how we need to prepare.
[1] Waldrop, M. M. (2016). More than Moore. Nature, 530(7589), 144-147.
[2] Friedman, T. L. (2016). Thank you for being late: An optimist’s guide to thriving in the age of accelerations. Farrar, Straus and Giroux.
Mythos Preview: a breakthrough in vulnerability discovery
No other use case demonstrates this uncertainty and the potential impact that it may bring as clearly as Anthropic’s Mythos Preview. On April 7, 2026[3], Anthropic released a publication in which they reported on the development of a new Large Language Model (LLM) that has shown astounding capabilities in terms of bug detection in existing software. The model is so powerful that it identified, weaponized and generated usable exploits for thousands of high severity vulnerabilities in existing, highly tested software in a matter of hours. Subjected to the analysis was virtually every major web browser, operating system and several of popular IT platforms (e.g. SAP, Salesforce, Servicenow and Workday). Among the software tested were both open, as well as closed source systems (the latter preceded by decompilation of binary files). The system identified vulnerabilities and provided both standalone exploits as well as complete exploit chains leveraging combinations of vulnerabilities. Examples include a 27-year-old denial of service vulnerability in OpenBSD that allows an attacker to crash a system running OpenBSD remotely by sending a malicious TCP packet. Note that, as OpenBSD is known for its robustness and high-level security, it is the standard operating system for many web facing devices such as firewalls, routers, and VPN gateways. Another example is a set of 20-year-old Linux vulnerabilities that allow an attacker to compromise a system remotely and/or perform privilege escalation attacks. Anthropic deemed their model so powerful that it decided not to make it public. Instead, it is currently working with a group of major software developers to help them identify and patch vulnerabilities found by Mythos Preview[4].
[3] Claude Mythos Preview — Assessing cybersecurity capabilities
[4] Assessing Claude Mythos Preview’s cybersecurity capabilities.
Structural weaknesses in software development
Human coding efforts are notoriously prone to the introduction of exploitable vulnerabilities. In 2025, Wochnik, Graupner, Spranger and Hummert found that each 100.000 human written Lines of Code (LoC) can be expected to contain one to two exploitable vulnerabilities[5]. Microsoft does not publish exact numbers on the length of the codebase of their software but estimates for e.g. Windows 11 range up to 100 million LoC[6], yielding up to 2000 exploitable vulnerabilities for the operating system alone. Demonstrative for this weakness is the amount of newly found vulnerabilities in Microsoft products that require patching each month during patch Tuesday.
[5] Regarding the Exponential Growth of Security Vulnerabilities | Springer Nature Link
[6] How Many Lines of Code are There in Windows 11?
The vulnerability storm
The developments portrayed above herald a storm in terms of reported vulnerabilities, patching requirements, system and network compromises and requirements for your security function. The rise in discovered vulnerabilities due to the availability of AI agents like Mythos Preview can be seen in the patching history of Microsoft for their monthly Patch Tuesday. The number of vulnerabilities patched in July of this year has more than doubled relative to June:
At this point in time, it is not sure if there are other parties (malignant or benign), which have developed similar capabilities as Mythos Preview. We can be sure however, that Anthropics publication incentivized other actors to up their research efforts to develop similar tooling. These actors will include AI and security vendors, nation states and criminal enterprises. It is a matter of time when this technology will fall in the hands of bad people. And if it does, it will dramatically increase their capabilities to spy, steal and sabotage their victims (being us). Any person or organization connected to the internet that has not subjected all software in use to the capabilities demonstrated by Anthropic will be fair game.
In the long run, this development will lead to the potential end of vulnerability abuse as we know it today, the need for bug bounty programs, and stringent patching procedures. The capacity demonstrated by Anthropic will be made available to any software developer willing to pay for it, and will likely be integrated into every Static, Dynamic and Interactive Application Security Testing suite. Organizations not using this technology as part of their development efforts will quickly be rooted out as they will most definitely be attacked by adversaries that do have access to the technology. They will either learn fast or cease to exist because of suffered damages. We will live in a much safer world in terms of cybercrime.
The challenge at hand
Before we reach this point, however, the world is at the forefront of an immense challenge. Until all humanly developed software is subjected to Mythos Preview like capabilities, and patched and updated accordingly, every organization, IT network and IT user will be vulnerable for the large amount of exploits we know will at some point in time be available to bad actors. Organizations need to act now to harden their IT environments and prepare their organizations for the upcoming storm. There will be a timeframe in which adversaries will have access to bug identification capabilities for any piece of software, be it open or closed source, while the software in use in organizations has not yet been subjected to analysis and improvement through tooling with Mythos Preview like capabilities.
What organisations must do now
At this point in time, Anthropic has not yet made the capabilities of Mythos Preview publicly available. Organizations need to be prepared for the moment Anthropic, or any other IT provider will. The capability will have to be purchased, implemented, and applied to the entire code base of each organization as fast as possible once it is made available. Where software of external providers is used (be it off the shelf or cloud based), these providers will need to subject and update their software. Where software is developed internally, it will need to be subjected to Mythos Preview like code scanning and updated. These conditions require organizations to start planning and performing the following actions today:
- make inventory of external software and respective vendors;
- challenge those vendors on how they prepare for the upcoming storm;
- design/implement and/or adapt existing processes to be ready to subject their code base to scans, updates and redeployments.
Further complicating this matter is the pressure of time. A vital metric indicating the need for speed is the currently observed Time-to-Exploit[7]. Zerodayclock.com keeps track of the time it takes before reported CVEs are observed as being exploited in the wild. A number that has decreased from 2.3 years in 2018 to as fast as 10 hours in 2026 (apparently, the bad guys have access to AI tooling as well). Hasty deployment however always goes at the cost of control, so organizations will need to devise a strategy where they both consciously weigh the speed of scanning and updating their code base against risk in their redeployment approach and challenge their providers on how they deal with this dilemma.
Given that it is currently not known if the potential demonstrated by Anthropic has been leveraged by, and made available to bad actors, organizations would do well to hope for the best but assume the worst. This means that the entire Cyber risk framework needs to be reconsidered and alternative measures may need to be implemented or existing measures may need to be sharpened to effectuate a defense in depth strategy minimizing the probability or impact of a breach following from zero-day exploits. Measures to be considered (not exhaustive) include[8]:
[7] As reported by Zero Day Clock.com
[8] The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program
- tailor your security strategy (adopt an “assume breach” mindset)
; - use LLM based vulnerability discovery and remediation capabilities;
- update risk metrics;
- accelerate your teams using coding agents;
- prepare incident management to respond to more incidents;
- increase focus on the basics (e.g. segmentation, patch and vulnerability management, system hardening, identity and access management, security monitoring);
- consider zero-trust architecture;
- re-prioritize cyber security resource activities, automate and prepare for burn-out;
- engage with sector coordinator groups.
Given the expected large number of patches to be released as the capabilities of Mythos Preview like solutions become available for vendors, it can be expected that the workload for the implementation of these patches will outweigh available resources within the context of Patch and Vulnerability Management. It is therefore highly recommended to prioritize the implementation of patches, assigning higher priority to systems connected directly to the internet, critical systems and systems holding sensitive data.
Another significant challenge organizations may face is the continued use of systems that have reached end of support or end of life. For end of support systems, it is advisable for organizations to assess whether the vendor offers extended support options and carefully consider investing in these services to maintain security and stability. However, any systems for which extended support is unavailable or prohibitively expensive, as well as all end-of-life systems, should be prioritized for decommissioning and replacement at the earliest opportunity.
How Eraneos can support your organization
Eraneos can support your organization preparing for, and navigating towards the Post-Mythos reality. Examples include:
Gaining full visibility of your IT landscape, critical assets and weak spots (e.g. web-facing and end-of-support/end-of-life systems)
Accelerating vulnerability and patch management with clear prioritisation and streamlined processes
Preparing your organisation for AI-driven security tooling, integrating it into your development and operations
Strengthening defence-in-depth (e.g. Zero Trust, segmentation, monitoring) to reduce the impact of zero-day exploits
Managing supplier risk by challenging vendors on their readiness
Designing pragmatic roadmaps to move towards a Post-Mythos security posture
With Eraneos, you don’t just respond to the vulnerability storm: you get ready to outpace it.
Conclusion: surviving the AI era
The coming of AI driven vulnerability identification ushers in a new era of robustness of software, limiting the business model of bad actors to find and exploit vulnerabilities and to spy, steal or sabotage our IT environments. It will be a bumpy road however before that scenario is reality. As always, evolution will allow the most fit (i.e. prepared) members of our population of organizations to survive and thrive, while weaker members will cease to exist. Organizations would do well to prepare for the inevitable storm ahead before a new evolutionary equilibrium is reached.
