The arrival of Claude Mythos in April 2026 sparked a media frenzy that pushed CISOs to react in two ways: either rush to purchase new tools, or quietly update their CVE backlogs in the hope of buying time.
Yet neither reaction truly addresses the problem. Mythos did not revolutionize cybersecurity. It mainly highlighted the scale of vulnerabilities that had remained unpatched up to now.
The illusion of vulnerability management
For years, the industry lived with a comforting fiction: the window between discovering a vulnerability and its exploitation gave security teams the time they needed to fix it. That window existed because attackers’ capabilities were limited; but with Mythos, that limit is disappearing.
According to Anthropic, the model can autonomously identify and exploit a vulnerability within a few hours. This speed challenges one of the foundations of security programs: the belief that there is still a sufficient window to remediate a flaw before it is exploited.
The figures confirm the scale of the problem.
According to Gartner, less than 1% of the vulnerabilities identified by Mythos have been patched. The real challenge, therefore, is not Mythos, but the accumulation of unpatched vulnerabilities, now within reach of any attacker equipped with comparable technology.
A study by Kenna Security and the Cyentia Institute also shows that 77% of known vulnerabilities have never been exploited in nature. The “detect everything, fix everything” model has always been more theatre than substance. Mythos has merely exposed its flaws.
That said, Mythos does not alter the nature of the principal obstacle. The true bottleneck has never been the discovery of vulnerabilities, but the ability to determine which ones should be addressed first. Among the thousands of CVEs present in an information system, which are actually exploitable from the Internet? Which affect the environment in place? Which remain exploitable despite compensating controls?
Mythos makes this question more urgent, without providing an answer.
Prioritizing vulnerabilities requires more than a CVSS score
The first reaction of many organizations will be to multiply scanners. Yet the problem lies elsewhere. CVSS scores assess the theoretical severity of a vulnerability, without considering its real exposure on the Internet or its operational impact.
What matters now is the context: knowing which vulnerabilities are actually exploitable within the company’s environment and which should be promptly remediated. A weekly scanner that generates a CSV file can no longer meet this challenge. When the exploitation window is measured in hours, you need continuous visibility over endpoints, installed software, actual running versions, and the interactions between system components.
By linking this detection to an EDR agent, security teams can quickly determine whether a critical CVE affects a component that is actually active in their environment. This visibility enables remediation prioritization based on real risk, rather than on theoretical severity alone.
Trying to fix everything is no longer a strategy; the challenge is to identify the handful of vulnerabilities that truly expose the organization and to concentrate remediation efforts on those.
With Mythos, a new standard is taking hold
Mythos marks the beginning of a new generation of tools. A few days after its launch, OpenAI unveiled GPT-5.4-Cyber, a model dedicated to cybersecurity research, already outperforming Mythos Preview on several benchmarks.
Meanwhile, SC World reported that an open-weight Chinese model, distributed under the MIT license, also outperformed several reference models in vulnerability detection, at roughly eight times lower cost.
The access controls put in place by Anthropic around Mythos provide a respite, but they do not alter the underlying trend. Capabilities are spreading, costs are dropping, and models are proliferating. Building a security strategy based on what Mythos can do today is already looking through the rearview mirror.
AI-assisted vulnerability discovery is now a durable reality that both attackers and defenders will have to contend with.
Vulnerability management is only a means, not an end
The real shift brought by LLMs and agentic AI does not lie only in their ability to discover vulnerabilities. It lies mainly in their capacity to accelerate every step of an attack after initial compromise. AI agents can exploit a flaw, escalate privileges, move laterally, and exfiltrate data at unprecedented speeds.
The traditional boundaries between desktops, browsers, servers, and applications become far less relevant. To keep pace, detection and response capabilities must also evolve to observe, understand, and contain AI systems capable of reasoning and acting autonomously, building on the security solutions already deployed on endpoints.
The next step will be AIDR (Artificial Intelligence Detection and Response). Not a new marketing label, but an evolution of the security architecture.
The goal is to entrust AI agents with alert triage, correlation of signals across the information system, and handling of repetitive tasks, so analysts can focus on decisions that require real expertise.
In this architecture, the VOC and the SOC can no longer operate in silos; as soon as a critical CVE is identified, the search for signs of exploitation must begin immediately. The gap between these two steps is now measured in minutes, not days.
The rules of the game remain the same
Mythos does not impose a new security paradigm; it obliges organizations to implement existing principles with the speed and precision that most have yet to achieve: visibility into assets, contextual prioritization, automation, continuous monitoring, at the pace of IA-assisted attackers.
Organizations that had invested in these fundamentals before April 2026 already know which vulnerabilities demand immediate intervention and which can wait.
This is not a product advantage, but an architectural decision taken long before the topic became unavoidable. The question is no longer what Mythos has changed, but at what vanished pace security strategies were built.
* Anouck Teiller is Deputy CEO at HarfangLab
