Mythos and the Cybersecurity Tipping Point: Why Business and Security Teams Must Align

The race between defenders and attackers may be accelerating. Anthropic’s Mythos, the next-generation model behind Claude, has attracted significant attention because of its ability to both identify software vulnerabilities and generate potential exploits. While AI-assisted vulnerability research is not new, Mythos appears to perform both tasks with unusual effectiveness, raising questions about how quickly vulnerabilities can be discovered and weaponized.

To evaluate the technology before broader release, Anthropic launched Project Glasswing, a limited-access program that allows select technology companies, cybersecurity vendors, and researchers to use Mythos for defensive security research. Participants can identify vulnerabilities in their own products and improve defenses before threat actors discover those weaknesses.

Anthropic recently expanded Project Glasswing beyond the United States to include organizations in the United Kingdom and European Union. A TechCrunch brief cited a Financial Times report that Anthropic has deployed a number of its engineers to the National Security Agency to help NSA spies use Mythos for “certain applications.”

Anthropic has also indicated that Mythos may become available to customers in the coming weeks; it appears to be finalizing the safeguards designed to prevent malicious use.

This Q&A with Michael DeNapoli, a Senior Solutions Architect at Pondurance, explores the latest developments surrounding Mythos and Project Glasswing, the implications for defenders, and why organizations may need to rethink traditional approaches to vulnerability management, patching, and cyber risk governance.

Q: Project Glasswing participants have already identified more than 10,000 critical- and high-severity vulnerabilities in their software. What do these findings mean for cybersecurity defenders?

Michael: The most significant implication is that defenders may be finding and fixing vulnerabilities faster than threat actors can weaponize them. While Anthropic has not publicly identified which organizations are using Mythos, we’ve seen several major technology vendors increase the frequency and volume of their security updates in recent months. That could reflect an evolution in vulnerability discovery and management, but it is also consistent with the capabilities Anthropic describes in Project Glasswing.

From a defensive perspective, that’s good news. Earlier vulnerability discovery gives vendors more time to release patches before attackers develop reliable exploits. In some cases, we’re seeing updates address substantially more vulnerabilities, including more critical issues, than was typical in the past. In April, Mozilla applied an early version of Claude Mythos Preview to its Firefox browser. Mythos identified 271 vulnerabilities, for which Mozilla said it provided fixes.

However, there is also a potential downside. Once a vulnerability is disclosed through a patch, threat actors can begin analyzing that update and developing exploits. As AI accelerates vulnerability discovery, the window between disclosure and exploitation may continue to shrink.

This means organizations can no longer rely on patch management practices that were acceptable a decade ago. Businesses routinely evolve their sales, finance, and operational processes as technology changes, and cybersecurity must evolve at the same pace. Organizations that can rapidly evaluate and deploy security updates will benefit from faster vulnerability discovery. Those that patch slowly may find themselves increasingly exposed as vulnerabilities become public knowledge more quickly than ever before.

Q: How can defenders patch vulnerabilities faster than threat actors can exploit them?

Michael: Organizations can shorten the time between identifying a vulnerability and applying a patch by changing both their business processes and their use of automation.

The first step is defining a coordinated business risk appetite. Many organizations still treat patching as a purely technical decision, but cybersecurity teams cannot move quickly if business leaders have not agreed on what level of operational risk is acceptable. For low-risk patches, organizations should consider applying updates immediately or enabling automated vendor updates. For higher-risk patches that could disrupt critical operations, they should establish a fast-track testing process with clearly defined timelines.

The challenge is that threat actors are moving much faster than they did a few years ago. Historically, organizations might spend two weeks testing a patch before deployment. Today, attackers often begin developing exploits within days of a vulnerability becoming public. For many organizations, 72 hours should be viewed as a maximum testing window.

Automation is equally important. Once a patch has been approved, organizations need a way to deploy it quickly across hundreds or thousands of devices. Platforms such as Microsoft Intune and other endpoint management tools can automate patch distribution, but many organizations don’t fully leverage those capabilities. Manual processes and user-driven updates create delays that attackers can exploit.

Ultimately, shortening the patching window requires business alignment, a risk-based approach to cybersecurity, and automation. Organizations that continue relying on patching practices designed for a slower threat environment may struggle to keep pace as AI accelerates both vulnerability discovery and exploit development.

Q: As Mythos moves closer to general availability, how could it change the way organizations approach cybersecurity and business risk?

Michael: Mythos is disruptive in the same way earlier technologies such as the PC, the internet, and SaaS transformed how businesses operate. AI is following the same pattern. What began as a tool for productivity, analytics, and software development is now reshaping cybersecurity, IT operations, and risk management. Mythos is an example of that shift.

The biggest disruption is that companies can no longer treat cybersecurity as separate from business operations. If AI can accelerate vulnerability discovery, it can also accelerate the speed at which threat actors identify and exploit weaknesses. That means technology risk must be managed like any other business risk.

A company would not wait years to change a failing sales process, finance process, or revenue-critical application. Yet many organizations still delay firewall upgrades, defer patching, or rely on outdated tools because cybersecurity is viewed as a technical cost rather than a business risk. Mythos makes that mindset much harder to sustain.

The practical impact is that business leaders, IT leaders, and cybersecurity teams will need to work more closely together. Technology and cybersecurity need a seat at the executive table when business processes change, new tools are adopted, or critical systems reach end of life.

In that sense, Mythos may be a tipping point. AI-driven vulnerability discovery is no longer theoretical. It is happening today. Organizations that adapt will be better positioned to move at the speed of the modern threat landscape. Those that continue treating cyber risk as a back-office technology issue may find themselves exposed to faster attacks, higher costs, including increased cyber liability insurance premiums, and greater business disruption.

The good news is that organizations already possess many of the tools, processes, and expertise needed to adapt. Those that align business, IT, and cybersecurity teams around a shared understanding of risk can turn AI-driven vulnerability discovery from a challenge into an opportunity to strengthen resilience and reduce breach risk.

Upgrade your security strategy for the AI era. Download Next Gen MDR: A Buyer’s Guide for the AI Age.