The Mythos AI Vulnerability Storm: Key CISO Takeaways

As the zero-day clock is ticking down fast, time has become the dominant risk variable.

Anthropic recently unleashed an AI vulnerability storm with its Claude Mythos (preview) – the company’s latest AI model which has been kept from the public because of its superior bug hunting capability. 

Exposing decades-old vulnerabilities in mainstream software, Mythos has stunned the security industry, evoking a united industry response in the form of Project Glasswing.

The community of security leaders published a recent paper with involvement from the Cloud Security Alliance (CSA) alongside SANS Institute and OWASP contributors titled The ‘AI Vulnerability Storm’: Building a ‘Mythosready’ Security Program.

This draft is an expedited strategy briefing and has contributions from the wider security community, released urgently for the nature of the threat and is authored by Gadi Evron, CEO at Knostic and CISO-in-Residence for AI at Cloud Security Alliance, Robert T. Lee, Chief AI Officer and Chief of Research at SANS Institute and Rich Mogull, Chief Analyst at Cloud Security Alliance. 

“Even with active human defenders and alerts, the speed asymmetry is what should keep you up,” Robert writes on his LinkedIn.

“The window between vulnerability discovery and weaponisation has collapsed into hours. 

“Autonomous attack chains move laterally from initial access to objective completion at a pace human defenders weren't designed for. 

“If your defensive teams aren’t using AI agents, they can’t match the speed of AI-augmented threats regardless of their technical skill.

The solution Robert notes is to: “Point AI agents at your own code and find the vulnerabilities before attackers do. 

“That’s Priority Action 1 in the briefing released today from Cloud Security Alliance, SANS Institute and OWASP GenAI Security Project.” 

The AI defence muscle: agents at every level

Leaning into AI tooling is now no longer an option for security teams but a strategic imperative to counter the AI-led malicious operation at machine speed.  

The paper notes: “The path forward is doubling down on fundamental security controls and hands-on adoption of agents at every level, from the CISO down. Every security role is becoming an ‘AI builder’ role and the barrier is lower than most people realise.”

Embracing AI agents for coding as part of the security fabric means operational acceleration can happen “beyond human speed”. 

This level of agent integration mandates strong governance and defence, as lapses can introduce a plethora of other safety risks. 

The key takeaway for CISOs here is the need to define scope boundaries, blast-radius limits, escalation logic and putting human overrides clearly set in the governance framework for AI agents. 

Securing the agent harness is crucial as it is the area where “most consequential failures occur”.

The paper acknowledges that “any program we build must acknowledge Mythos is only the first wave of future AI technology disruptions.

“In building a Mythos-ready program, we are not only seeking a return to equilibrium but also preparing to maintain balance for the waves ahead.”

As Rich, one of the main authors noted on his LinkedIn: “Attackers already operate as collectives. This brief is proof that defenders can do the same and do it fast.” This is a wake up call for security leaders to act as a collective to secure critical software. 

The need for an “aggressive plan”

When bad actors gain access to powerful AI models that can hunt for vulnerabilities faster than humans, security teams must prepare “triage and deployment capacity to handle a potential flood of patches”. 

Most risk models require updating in the new AI reality.  

Equally important is reducing the attack surface by aggressively shutting down unmaintained functionality and phasing out suppliers who do not comply with the new vulnerability management requirements. 

Isolating at-risk systems to create an air gap is pivotal, along with enforcing zero-trust, deep segmentation and egress filtering, which blocks every public log4j exploit. 

Having pre-authorised containment actions and response playbooks – crafted by careful study of the threat actor attack patterns – ready to execute at the speed of machines is crucial.

“The paper models what happens when AI drives vulnerability discovery and exploitation faster than organisations can respond,” notes Wendi Whitmore, Chief Security Intelligence Officer at Palo Alto Networks.

“Time is becoming the dominant risk variable. Which shifts the question: Not ‘can you stop the attack?’ but ‘can you operate through it?’”

“At Palo Alto Networks, this reinforces the direction we’re already driving toward: Platform visibility, faster response and containment at scale.

“Because the gap between what we know and what we can execute is becoming the risk surface.

“This isn’t about new controls. It’s about operating at a completely different speed. That’s the shift.”