> The ‘Mythos moment’ has already passed. Now comes the hard part for cybersecurity

When Anthropic introduced Claude Mythos Preview, the cybersecurity debate quickly turned to what AI could do: uncover decades-old vulnerabilities, develop working exploits and accelerate tasks that once required specialist expertise. Anthropic noted that Mythos discovered software flaws no human had caught, and early tests showed it could carry out multi-stage network attacks in minutes, tasks that once took skilled pen testers days. Security leaders and cyber defenders let out an initial sigh of relief when it was announced that Mythos would be available to a select few, with an extension to 150 other organizations. The Mythos moment and hype have now passed, and the harder task is turning its warning into practical defensive readiness. In other words, the “ Mythos moment” and the initial “shock” is over. Now comes the hard part: can organizations identify their exposures, prioritize real risks and patch or mitigate them fast enough to stay ahead of AI-powered attacks? Can they be as fast as AI in even discovering them to begin with? AI-accelerated attacks are already here to stay There is no hiding from it now; AI-enabled and accelerated attacks are here already, and they are already rewriting cyber-attack playbooks worldwide. In 2026, Stanford’s AI Index reports that AI agents now solve cybersecurity problems 93% of the time, up from just 15% in 2024. Independent tests confirm this trend: the UK’s AI Security Institute (AISI) found Claude Mythos Preview could autonomously execute a 32-step simulated corporate network attack (a scenario that humans would take ~20 hours to complete) and retrieve flags hidden on target machines. In short, frontier AI models can chain together reconnaissance, exploitation and privilege escalation without human help. In these trials, Mythos reliably discovered and exploited vulnerabilities autonomously, tasks that would take human professionals days of work. Allied research backs this up. A Cloud Security Alliance report notes that attackers now operate at machine speed, whereas defenders still often operate on “organizational speed.” In practice, this means patch cycles of weeks or months no longer keep pace with exploit windows measured in hours. Widely deployed software (operating systems, browsers, network devices, etc.) – precisely the high-impact targets many enterprises depend on are now rapidly weaponized. Email is also not spared as attackers have now stepped up how they leverage AI-enabled prompt injection phishing attacks to deceive employees into wiring money to fake accounts, Vulnerabilities and exploits are exploding in growth Data shows this isn’t a theoretical worry: the volume of known flaws and their exploitation is surging. Google’s Threat Intelligence group found that reported vulnerabilities doubled from January to July 2026 (rising from ~5,000 to over 10,000 per month). At the same time, the number of those vulnerabilities actually exploited in the wild nearly doubled, from an average of ~10.5 per month in 2025 to ~18 per month in early 2026. Even zero-day (previously unknown) exploits ticked up slightly. Google and others warn that this trend will continue. If rapid AI-assisted discovery and exploitation keep accelerating, defenders cannot afford “unprioritized mass-patching” as in the past. Instead, they must move to a threat-intelligence-driven triage model: focus on the vulnerabilities actually being targeted, and automate as much response as possible. This means continuous scanning, asset inventory and risk-based prioritization — often called exposure management using tools like Wiz, Tenable and Microsoft Defender for Cloud. For example, Security Boulevard explains that an exposure management program uses AI to constantly map assets, vulnerabilities and misconfigurations, then automatically prioritize and remediate the riskiest ones. This approach is essentially a “Mythos-ready” security program — one designed to handle the avalanche of findings that AI will generate, and to fix them at machine speed. AI, essentially battling AI Using AI defensively Importantly, defenders can use AI as well as attackers, so it benefits both sides of the coin. Anthropic’s own Project Glasswing is a case in point, as seen earlier. In early April 2026, only ~50 organizations were testing Mythos Preview, but within weeks they had already run it across their codebases and uncovered over 10,000 high- or critical-severity flaws. Anthropic is now expanding Glasswing to ~150 additional organizations deemed critical (power, healthcare, communications, etc.) whose code impacts millions of users. The aim is to train industry on new AI-powered workflows: Partners share best practices, triage vulnerabilities together and even use AI to suggest fixes and pre-emptively harden code. Glasswing’s lessons show that AI can speed up defensive tasks too. For example, Mythos-level models can be repurposed to write patches or convert legacy code into memory-safe languages, and to run “AI red teams” against one’s own systems. Anthropic reports that partners are now using Mythos to automatically generate fixes, and their new public tool (Claude Security) helps scan code and suggest patches using a slightly safer variant of Mythos. In practice, organizations should consider adding AI to their security toolchain and leverage automated penetration testing, intelligent asset discovery and tagging, and AI-assisted patch generation to help keep pace with attackers. Reinforce the fundamentals Even as we deploy sophisticated tools, the basics still matter more than ever. AISI emphasizes that Mythos’s impact actually highlights the importance of cybersecurity basics — regular patching, strong access controls, secure configurations and comprehensive logging, just as is seen in the UK’s Cyber Essentials. In other words, if attackers can automate exploits, defenders must double down on hygiene and detection. With exploit windows collapsing to hours, organizations may need to accelerate patch cycles. This might mean more frequent updates, rolling hotfixes, or virtual patching via network controls when immediate fixes aren’t available. Least privilege and segmentation also must be in place to reduce each user or system’s access to only what it needs. An attacker (or malicious AI agent) with stolen credentials should find it hard to move laterally or escalate privileges. Network segmentation and micro-segmentation can slow or isolate attacks even if they penetrate the perimeter. Incident response rehearsals should also update playbooks to account for fast, AI-enabled attacks. For example, test scenarios where key accounts or credentials are compromised and ensure “break-glass” administrative accounts or recovery keys are secured (offline if possible) so you can take back control even if your primary identity provider or domain is down. In short, building resilience means blending new AI-driven practices with solid engineering. As Anthropic warns, Mythos-class capabilities are coming to many organizations soon and with fewer safeguards than the preview had. There is also no saying if China will get their hands on something similar and make it open source, which means attackers will also gain access to it. Security teams must adapt now by working at machine speed: automate exposure discovery and patching, enforce strict access controls, and enhance detection and response. Only by assuming that some attacks will succeed can organizations design defenses that contain the damage. The Mythos moment, when powerful AI grabbed headlines, has indeed passed and what matters now is translating its warning into practical readiness. The AI genie is out of the bottle, and cyber attackers will leverage these tools at the same time as we also tell it our security wishes.