The old and the new: Mythos changed pace, but not the fundamentals for prepared organizations

An overview of Mythos-class frontier AI models, their significant (and sometimes over-simplified) impact on cybersecurity, and Specular’s view on how to help proactive organizations use this for a defensive advantage.

Summary

Mythos represented something of a watershed moment for AI’s use in cybersecurity. It changed a lot of the possibilities and the discourse, but its impact is also over-stated in some quarters, especially for organizations who properly embraced AI in their security operations 2+ years ago. 

Mythos-class cyber-capable models are a game-changer in pace, not in kind. More attackers can now find vulnerabilities faster than ever, and the next models will keep pushing that further. But those same advances hand defenders a bigger edge, because they hold context attackers never will: internal documentation, infrastructure knowledge, source code.

Specular has been working on these challenges with proactive organizations since before Mythos, with continuous 24/7 coverage of internet-facing services, and leveraging AI agents to streamline analysis of internal services. This blog sets out what Mythos actually is and does, how the threat splits across two vectors, why legacy tooling cannot keep pace, and where Specular sees opportunities to help organizations deal with all of this.

Mythos: what it is, before & after

In April 2026, Anthropic released Claude Mythos, a general-purpose AI model that is strikingly capable at cybersecurity tasks. These include autonomously finding vulnerabilities in software and building working exploits for them. Because of that capability, access is tightly gated. Anthropic restricts Mythos to vetted organizations under its Project Glasswing program, pairing the model with vendors of critical software to find and fix flaws before attackers can.

The announcement was greeted with equal parts excitement and fear by much of the industry, viewing it as a game-changer. Since then, subsequent releases, such as OpenAI's GPT-5.5-Cyber, Anthropic's Fable 5, and even select open-weight models, (recently benchmarked as 4-7 months behind leading frontier labs) have only intensified the noise around AI's capabilities as a force-multiplier in offensive and defensive security.

April 2026 research by the UK government's AI Security Institute (AISI) and independent AI security evaluation labs (e.g. Irregular and AISLE) has shown AI models increasingly capable of autonomously undertaking complex, multi-stage cyber tasks. And the recent OpenAI / Hugging Face incident shows the potential exacerbated consequences of such models without safeguards (an increased risk as open-weight models catch-up with frontier labs). However, the same research shows that much of that capability (vulnerability discovery in particular) existed before Mythos and had been improving steadily over the last couple of years. The advent of agentic AI, as opposed to just GenAI alone, and properly harnessed setups, has proven as big a change-factor as the improving models alone.

The early Project Glasswing results make the scale of impact concrete: Cloudflare reported roughly 2,000 vulnerabilities found across its critical systems (around 400 of them high / critical severity), and Mozilla found 271 vulnerabilities in Firefox 150, more than ten times what a previous release surfaced with an earlier model. Organizations need to therefore prepare for an incoming surge of vulnerabilities, and to be able to identify, triage and remediate at machine-speed to stay ahead of real attackers.

Mythos is a real acceleration of a pre-existing trend. But it was an evolution, not an out-of-left-field threat. Organizations already using AI proactively in their cyber operations do not need to change course, but should stress test their workflows and systems to ensure capability for increasing volume.

The vulnerability problem

Verizon's 2026 Data Breach Investigations Report marked the first time in the report's 19-year history that vulnerability exploitation overtook stolen credentials as the number one initial access vector in real breaches: 31% vs 13%. Notably, the breaches behind that data largely predate Mythos… attackers were already winning this way; AI is now accelerating them.

This is a marked change from the cyber landscape of the last 15 years, where phishing and broader identity theft were the primary mechanisms. Vulnerabilities in external assets (especially with the huge sprawl of external assets that came with cloud, SaaS usage, and now third-party AI systems and MCP servers) are the primary way attackers will breach your organization.

Mythos-class models have made vulnerability identification and exploitation drastically easier and advancing AI capability in general will continue to do so.

The legacy methods of dealing with vulnerability discovery, with legacy VM vendors such as Qualys and Tenable, are unable to keep pace because they:
  • Don't work fast enough.
  • Generate huge quantities of false positives.
  • Lack the internal context to properly reason on risk.
  • Offer limited help with remediation.

First-generation ASM and CTEM vendors have advanced on this, offering continuous coverage and often cutting-edge vulnerability research. However, their focus is external alone, and they architecturally lack the necessary inside-out context to properly solve the issue.

How advancing AI is changing cybersecurity

Mythos-class AI models, properly harnessed agentic AI, and the rest all center on 3 significant impact points in cyber:

  1. The collapsing of skillset/time as a limiting factor in the majority of vulnerability discovery. Put simply, the skill required to identify vulnerability has been drastically lowered, allowing more attackers than ever to discover vulnerabilities faster than ever before. The impact is real and the increasing pace of discovery is not overstated.
  2. AI as a force-multiplier in defensive work- chiefly because more context leads to better triage and remediation. AI is good and bad at many things, but it is primarily good at consuming huge quantities of data and building context across systems in ways not before feasible, unless you had hours upon hours of manual time on hand. In cyber, this comes to the fore in areas such as a) reviewing internal documentation to build context on vulnerabilities, b) providing actual, actionable remediation advice; not just finding issues, and c) changing the dynamics of human work and information overload in detection workflows.
  3. General efficiency gains across all aspects of cyber work (e.g. reporting, triage, correlation, normalization, etc), due to abilities of automation that were not previously accessible.

Increased threats due to Mythos-class AI models therefore come from:

  • Large incoming surges of new vulnerabilities that organizations will need to quickly triage (causing alert fatigue and coming with lots of false positives).
  • Lower-difficulty, faster identification of external and internal vulnerabilities, and all the downstream risk that goes along with that.

With those advances also comes increased defensive opportunities:

  • Finding those same vulnerabilities quicker ourselves.
  • Enriching the discovery process with all internal data and context to streamline analysis and remediation of vulnerabilities and misconfigurations which is an advantage external attackers don't have.
  • Using internal business context to actually remediate and fix those vulnerabilities more quickly than before.
  • Reducing noisy false positives because of better context, risk scoring, and automated agentic workflows.
The same AI that speeds attackers up hands defenders a bigger advantage, because defenders hold internal context attackers do not have access to.

Organizations who are succeeding

The organizations succeeding with AI in their cybersecurity operations are the ones that adapted early, including those: already putting cutting-edge AI to work on vulnerability discovery back in 2023, building proper agentic harnesses through mid-2025 rather than scrambling to start now, and setting rigorous, proactive AI adoption plans rather than waiting for unchecked shadow AI to spread.

For those organizations, the post-Mythos question is not "how do we start using this in our cyber work?" That has been happening for years, and these same threats have been modeled just as long. For them, the Mythos change is a heightening of volume and pace, not a new threat category.

The real decision now is how to embrace these new technologies so that defenders are not eaten up by attackers harnessing these new tools at machine speed. As they are able to cut away legacy solutions no longer offering meaningful defense in the new landscape, they’ll then be able to regain confidence in dealing with Mythos-class vulnerability identification to better protect their critical assets. 

Ideally, the time to start was two years ago, but if you’re just starting now, it’s not too late! Organizations leveraging frontier AI in their cyber defense will still be able to counter attackers using the same software in their cyber offense. In fact, this is exactly what Specular helps our customers do.

Key threats organizations face: and how to address

All of the above centers on two threat vectors: outside-in (attackers discovering and exploiting your external vulnerabilities) and inside (vulnerabilities across your internal network and source code).

To cover both in practice, we can consider this as broken into four capability areas:

  • ASM (outside-in): Continuous awareness of what you have exposed and which new vulnerabilities/CVEs affect it, to stay ahead of Mythos-class vulnerability discovery. Point-in-time snapshots or manual pentests cannot keep up with attackers who scan continuously.
  • Vulnerability identification: Vulnerabilities are the number one way attackers get in, and the scale of discovery is exploding with AI. Legacy approaches and VM vendors can't keep pace with this.
  • Hyper-personalization (internal): The main gap that incumbent ASM, VM and CTEM vendors don't address. Organizations hold a wealth of internal knowledge (knowledgebases, ticketing systems, documentation, asset context), and the tools now exist (AI/RAG) to consume it and absorb that context.
Specular is built with that idea first, rather than trying to bolt it on like incumbents (i.e. this is an architectural choice, not just a new product from a legacy vendor).
  • Remediation: Routinely overlooked in favor of vuln/risk discovery alone. Even new-gen vendors don't have enough context to do this properly. Some newer tools and frontier-lab offerings (Claude Code Security, Codex, etc.) focus on code-level remediation well, but are not focused on your organization. Few have the unified picture of outside and inside: discovery and context feeding tailored remediation plans, the way Specular does.

Where Specular helps

  1. Continuous discovery of all internet-facing services: 24/7 discovery and change monitoring of every internet-facing service, spanning on-prem, cloud, and third-party infrastructure.
  2. Automated AI-led vulnerability identification: Specular's agents find vulnerabilities - spanning newly disclosed CVEs, unknown vulnerabilities, and misconfigurations. The agents then validate any finding’s real exploitability.
  3. Expedite remediation with internal knowledge stores: Specular’s agents consume internal context and knowledgebases through RAG (Retrieval-Augmented Generation). This provides an edge attackers cannot have, and is used to streamline remediation with environment-specific guidance.

If you’re interested in seeing how Specular could bring this help to your organization, reach out to schedule a demo.

References

Table of Contents
Share this article