Here’s what our industry learned the past 90 days since the Mythos announcement

COMMENTARY: Yesterday marked three months since Anthropic made the unprecedented decision to delay the broader release of its Mythos model over concerns about its cybersecurity capabilities.

Since the April 7 announcement of Project Glasswing, what began as a debate over whether frontier AI could help hackers has evolved into a much larger conversation about how AI has reshaped software security itself.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

The announcement represented more than a product delay. It served as a public acknowledgment that AI had reached a point where its ability to discover software vulnerabilities and generate exploit paths was advancing faster than many organizations' ability to defend against them.

For years, security leaders have discussed the possibility that AI would eventually accelerate offensive cyber operations. Mythos transformed that discussion from a future-looking hypothesis into an immediate operational concern.

Over the past three months, the industry has begun adjusting to a new reality. We no longer view AI simply as a productivity tool that helps developers write code or assists analysts with investigations. It’s emerged as a force multiplier for vulnerability discovery, capable of identifying weaknesses at a pace that challenges traditional security workflows. As the time between vulnerability discovery and exploitation shrinks, organizations are now forced to rethink long-standing assumptions about patch management, vulnerability prioritization, and cyber defense.

This shift extends well beyond one AI model or one vendor. Whether organizations use commercial frontier models, open-weight alternatives, or internally developed AI systems, the underlying trend remains the same: AI has dramatically compressed the window defenders have to identify, validate, and remediate software flaws before attackers can weaponize them. In many ways, the security industry has entered an era in which the speed of decision-making may become just as important as the quality of detection.

For CISOs, software vendors, and security teams, the past 90 days have offered several important lessons about preparing for this new environment.

AI presents very real risks

For years, discussions around AI-driven cyber threats largely centered on the technology's ability to generate convincing phishing campaigns, automate malware development, or improve social engineering attacks.

While those capabilities remain important, Mythos highlighted something potentially more consequential: AI's ability to discover previously unknown software vulnerabilities and rapidly transform them into functional exploits.

That changes the economics of cyberattacks. Vulnerabilities that may have remained undiscovered for months, or even years, can potentially be identified in hours, dramatically reducing the amount of time organizations have to respond. Security teams operating under traditional allow-by-default models or relying on lengthy remediation cycles are increasingly exposed to this new reality.

The strongest defensive strategy remains zero-trust

The emergence of AI-assisted vulnerability discovery does not fundamentally change what defenders should do – it reinforces why modern security architectures matter.

Software does not distinguish between an exploit written by a human researcher and one generated with AI assistance. The questions remain the same: What's allowed to execute? What resources can it access? Can compromised systems move laterally? Can attackers escalate privileges?

That’s precisely why zero-trust principles continue to gain momentum. Deny-by-default policies, least-privilege access, application control, segmentation, and containment all help reduce the blast radius when vulnerabilities are inevitably discovered. AI may increase the speed of attacks, but limiting implicit trust remains one of the most effective ways to slow attacker progress once an initial foothold is established.

Restricting one model will not solve the problem

While Anthropic's decision demonstrated responsible stewardship, limiting access to a single frontier model does little to eliminate the broader challenge.

Nation-state actors, cybercriminal organizations, and sophisticated adversaries have access to numerous AI capabilities through open-weight models, compromised accounts, and alternative platforms. Just about anyone can access the technology today.  

The greater risk we now face: unintentionally slowing legitimate defenders while adversaries continue advancing. Security teams need access to the same AI-powered capabilities to proactively identify vulnerabilities, validate security controls, and accelerate remediation before attackers can exploit weaknesses. Rather than attempting to contain AI, organizations should focus on using it responsibly to improve defensive operations.

Speed makes prevention more important than ever

Most of us have learned over the past three months that cybersecurity has become a race against time.

As AI shortens the path from vulnerability discovery to exploitation, organizations can no longer depend exclusively on detecting attacks after they have begun. Detection and response remain essential, but they are increasingly insufficient on their own.

Prevention must once again become a strategic priority. Reducing attack surfaces, hardening systems, eliminating unnecessary privileges, and remediating vulnerabilities before exploitation all become significantly more valuable when attackers can automate discovery and weaponization at machine speed.

Prevention must keep pace with AI

The last 90 days have fundamentally changed the security calculus. Anthropic's Mythos announcement did not just simply highlight the risks of one powerful AI model – it demonstrated how quickly AI has reshaped the economics of offensive cybersecurity.

The organizations best positioned to succeed in this new environment will accept one simple reality: defenders cannot afford to move at yesterday's pace against tomorrow's threats.

By embracing prevention-first security strategies, accelerating remediation, and continuing to invest in zero-trust architectures, organizations can shift the advantage back toward defenders.

AI will continue accelerating both sides of the cybersecurity equation, but the organizations that prioritize resilience, speed, and proactive defense will stay ahead as this new era unfolds.

Danny Jenkins, chief executive officer, ThreatLocker

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.