Anthropic's Mythos AI model landed with a loud thud in April, shocking the cybersecurity industry and security managers with the
frightening number of zero-day vulnerabilities it can quickly discover. Yet the real significance of Mythos isn't how many security flaws it finds. It's how it finds them.
"The number isn't actually the story," explains Brinqa COO and CSO Brad Hibbert. "The story is how it gets there."
Mythos doesn't scan for known CVEs or match signatures to
vulnerability databases. Instead, it thinks like a veteran security researcher (or a roomful of them), reasoning its way through software, forming hypotheses about where vulnerabilities might lie, testing its hypotheses, and adapting its approach until it confirms exploitable weaknesses.
For the moment, Anthropic is restricting the use of Mythos to big-name software, banking and cybersecurity companies. The company deems the AI model's abilities too dangerous for public use. But it's likely only a matter of time — most experts reckon between six and 18 months — before similar
AI models become widely available to attackers and defenders alike.
As we await that so-called "Mythos moment" and the expected flood of new vulnerabilities, organizations need to prepare.
Exposure-management platforms that mimic Mythos' own reasoning can show organizations which vulnerabilities truly matter within their own environments and give them opportunities to orchestrate remediation before Mythos-guided attackers can strike.
How Mythos thinks
Mythos follows an iterative process aimed at finding entirely new security flaws. It is given a simple eight-word prompt: "Please find a security vulnerability in this program." The process may vary from one assignment to the next, but the steps generally include:
- Creating an isolated container, cut off from the internet, in which to safely run the targeted software and analyze source code or inspect binaries without interference.
- Building a comprehensive map of the software and its architecture, identifying trust boundaries, authentication logic, data flows, and other security-sensitive components.
- Generating hypotheses about where serious vulnerabilities are most likely to exist in the software. Mythos then runs the software to test each hypothesis. If it gets no result, it backs up and starts again on the next potential vulnerability.
- When a genuine vulnerability is found, Mythos writes a bug report, often with an accompanying proof-of-concept working exploit.
- Finally, Mythos agent passes on the report (and exploit) to a second AI agent, which offers its own opinion on whether the bug the first agent is real, screening out likely false positives.
"It's like having a security researcher that never sleeps," says Hibbert. Or, he adds, because multiple Mythos instances can run simultaneously, "a building full of security researchers."
Why what Mythos finds is especially dangerous
Mythos' most important ability is not finding individual vulnerabilities but uncovering hidden attack chains. By trying all possible combinations — including those that human researchers don't time to investigate — it can link low- or medium-severity flaws into a full- compromise path that leads to privilege escalation, remote code execution, or sandbox escape.
This undermines remediation strategies that look at vulnerabilities one by one and prioritize them accordingly, leaving seemingly small stuff unpatched even though it may form part of an exploitable attack path.
"If you have a number of low- or medium-priority vulnerabilities, they're kind of farther down the queue and they never get dealt with," Hibbert notes. "They're not seen as being as important."
Another big problem: AI models like Mythos democratize high-impact zero-day discovery because they greatly reduce the cost and time needed to find and weaponize vulnerabilities and attack chains.
Mythos "changes the economics of the cyber threat," says Hibbert. "What used to require a highly skilled researcher and days or weeks of work is now a line item that fits in a modest budget."
The altered economics shrinks the window of time that organizations have while they get ready for the Mythos moment, Hibbert adds.
"From a nation-state perspective or from a well-funded criminal-organization perspective, you're probably less than 12 months," he says. "And then from broader availability, I think it's less than 24 months."
Why context matters, and how to get it
While Mythos figures out whether a given vulnerability is exploitable in its sandboxed container, exposure-management providers like Brinqa focus on whether that vulnerability is exploitable within your enterprise environment.
Exposure management correlates vulnerability data with asset inventories, network topology, identities, business criticality, threat intelligence, and compensating controls to create a dynamic model of each organization's environment, a map that Brinqa calls a Cyber Risk Graph.
"That's the same relational reasoning Mythos uses offensively, applied defensively," says Hibbert.
With this information, an organization can understand which new vulnerabilities and attack paths, whether discovered by a human or an AI model, truly threaten their critical assets, and which can be safely ignored.
Brinqa's membership in Anthropic's Cyber Verification Program means that it gets privileged insight, with added technical details, into the vulnerabilities that Mythos or other models find.
"Understanding which vulnerabilities, in combination, create viable paths to your critical assets is a more honest picture of your actual risk than a list of unpatched CVEs sorted by CVSS score," says Hibbert.
Security teams are already swamped with too many vulnerability findings. AI models like Mythos will make it much worse. Exposure management cuts down on the noise by aggregating data from hundreds of security tools, prioritizing the weaknesses that matter most, and orchestrating remediation across development, operations, cloud, and infrastructure teams.
Beyond applying exposure management and other proactive tools, Hibbert says that an entirely new security mentality is needed to properly fortify the organization.
"Stop treating every CVE as equal. Start trying to understand things by adding in real-world context," he says. "Start thinking about your assets and asset criticality [and] in terms of the attack path, and not specific individual findings."
In an era of AI-speed vulnerability discovery, understanding context — not desperately patching flaws as they come — will determine which organizations remain resilient.
"The tools to find and exploit vulnerabilities at scale, cheaply, and autonomously, already exist," says Hibbert. "The defenders who take that seriously and build the organizational capability to match that pace are the ones who will be in a position to protect their environments."
"Everyone else," he adds, "is betting that they won't be the target."
