Since the launch of Anthropic’s Mythos, the debate around the risks that AI-powered tools pose for security teams has steadily ramped up.
Yet, fundamentally, the attack targets aren’t changing: the big shift is one of scale and speed. AI finds more vulnerabilities, giving security teams more to deal with. But at the same time, AI is lowering the technical barrier to exploitation. The result is a situation where the window of time that teams have to respond has drastically reduced.
This has clear implications for how organizations approach exposure management and reinforces the need for solutions that help security and IT teams stay secure amidst this new reality.
Vulnerability detection is accelerating
The initial update from Project Glasswing underlined the power behind the Mythos model that has fueled so much speculation and concern.
In approximately one month, Mythos and around 50 partner organizations reportedly identified more than 10,000 high and critical severity vulnerabilities, with 6,202 estimated high/critical vulnerabilities found across more than 1,000 open-
There’s no doubt Mythos is hugely consequential and its capabilities mark a significant milestone, but the gap between attackers and defenders has already been widening for some time. Security teams have been facing a growing volume of CVEs; in 2025, some 48,185 CVEs were published, a 20.6% increase from the previous year and Advances in AI tools can reasonably be expected to continue fueling this trend for years to come.
This all has huge consequences for security teams. As Cloud Security Alliance analysis has reported, Mythos-type capabilities will mean the number and frequency of complex, novel attacks will rise dramatically alongside the need to patch and respond to AI-discovered vulnerabilities, exploits and autonomous attacks.
0-day vending machines, no Mythos required
Restricting access to Mythos and other highly capable models is not a practical safeguard. Our research and testing demonstrates the capabilities of general access LLMs in finding and exploiting novel vulnerabilities when being prompted by experienced security practitioners.
One of our security researchers created an automated vulnerability research pipeline, with no human in the loop. On first deployment, this found a remote, multi-stage SQL injection vulnerability sitting on 300,000 WordPress plugins, a process fully automated from discovery to exploitation. The finding, which aligned with an independent discovery by another researcher, was assigned CVE 2026 3985 and publicly disclosed.
And it’s not just the power of AI in finding vulnerabilities that should cause concern. AI-powered attacks can go a step further in automating an entire extortion attempt. An agent can autonomously create and send the exploit, then demand a ransom as we saw when an operator dubbed JadePuffer, exploited a vulnerable Langflow server, harvested credentials, moved laterally and encrypted 1,300 database records in an end-to-end agentic ransomware operation.
Reduce the attack surface as a first line of defense
This is our ‘new normal’ and LLM models have changed the old assumptions about the speed of vulnerability management. The window that existed between vulnerability discovery, CVEs assigned and defensive action being taken, has fundamentally shifted.
It’s not just about reaction times. Teams also need to take proactive steps to reduce their attack surface as the race to patch can be avoided entirely if assets weren’t unnecessarily exposed in the first place. This is about fighting the battle on two fronts; closing the window between vulnerability detection and remediation and taking pre-emptive action to make the target that attackers aim at smaller in the first place.
These should go hand-in-hand as many teams focus on patching what’s vulnerable, but they also need to question if it should be exposed at all. Attack surface reduction is an area that many organizations may struggle with, but any unnecessarily exposed internet facing asset is now carrying far more risk than ever.
Exposed services, such as leaving a MySQL database or private API documentation exposed to the internet, is an open invitation for attackers and these often don’t even need a CVE to be exploited. This leaves the door open for automated, high-speed attacks.
Always on exposure management
When time to exploit is reduced down to hours, the second key focus area for security teams is reducing the gap between discovery and remediation.
Finding and fixing vulnerabilities requires both context and cadence. Pentesting provides the depth and context but is a ‘point in time’ activity and frequent in-depth investigations can be cost prohibitive for many organizations. Vulnerability scanning provides the cadence but can’t interpret if what it’s found matters for your business environment.
That’s where AI can help and, whilst the traditional pentest isn’t going to disappear right away, we’re at the beginning of an era in which AI offers a new way to support the work that human security analysts and engineers are doing.
Its value lies in instantly alerting teams to new risks, the ability to deploy a pentest on every major release for the fraction of the cost of a manual engagement, agents that can actively investigate and validate findings using the same methods employed by human security experts, and integrating with the tools your teams use to get issues to the right people for fixing, fast.
This way, stretched teams can keep up with the emerging threat landscape. AI is helping teams cross that last mile – validating findings, reducing false positives, and providing necessary context.
These are still relatively early days and the frameworks around the pentest, used by auditors, insurers and compliance bodies, will need to evolve. But the signs are that this new era requires continuous testing as standard practice.
It’s needed because Mythos, and other LLM models, will punish anyone still working to yesterday’s timelines. The fundamentals of reducing exposure, validating what’s real, and freeing skilled people from the noise haven’t changed. What’s changed is how little time is left to get them right.
We’ve featured the best endpoint protection software.
This article was produced as part ofTechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:https://www.techradar.com/pro/perspectives-how-to-submit
