In April 2026, Mozilla shipped fixes for 423 security vulnerabilities in Firefox in a single month. A year earlier, that number was 31. This was not the result of exceptional human effort. It was the result of privileged access to Claude Mythos Preview, Anthropic’s AI model, through Project Glasswing, a restricted coalition of around fifty organizations, predominantly American, whose offensive capabilities led Anthropic to limit access before any public deployment.
What Mythos did for Firefox, it did without fatigue, without tunnel vision, without ever missing a rare edge case through lack of concentration. In a matter of weeks, it identified 271 vulnerabilities, some of which had been dormant in the code for 15 years. “It is difficult to overstate how much this dynamic changed for us over a few short months,” said Brian Grinstead, distinguished engineer at Mozilla, in TechCrunch on May 7, 2026. What changed is not the nature of the vulnerabilities. It is the speed and scale at which they can be found, and potentially exploited
Your organization is not in Glasswing. The question is: are you ready for what comes next?
What Mythos Actually Changes, and What It Does Not
The UK AI Security Institute published an independent evaluation of the model on April 15, 2026. Under controlled conditions, Mythos is the first model to complete end-to-end the “The Last Ones” simulation: 32 sequential steps from initial reconnaissance to full corporate network takeover, a sequence a human expert would take approximately 20 hours to complete. Success rate: 3 out of 10 attempts. Cost per attempt: approximately £65.
Two essential caveats that most commentators overlooked. The environments tested by AISI had no active defenses, no automated detection, and no incident response team. These results confirm that Mythos can attack poorly defended systems autonomously, not necessarily hardened enterprise networks with an active SOC. Furthermore, several cybersecurity firms confirmed to CNBC on May 8, 2026 that they had reproduced comparable results using existing models through better orchestration. Mythos does not create offensive capability. It makes it accessible at an unprecedented cost.
The CLUSIF, France’s reference association for information security, noted in its April 2026 analysis that Anthropic is reportedly preparing a 2026 IPO, and that generating buzz in this space would likely enhance the company’s valuation. This dimension does not invalidate the technical results, which are verifiable and confirmed by an independent government evaluation. It simply invites a distinction between what is documented and what is announced. The Bloomsbury Intelligence and Security Institute put it precisely on April 28, 2026: “Mythos changes the economics of cyber operations. The constraint shifts from detection to remediation.”
The Real Problem: A Widening Gap
Finding a vulnerability has never been enough to protect an organization. Vulnerability management involves at least six steps: identification, qualification, prioritization, remediation, verification, and documentation. Anthropic’s communication focused on the first. It is precisely the least problematic.
Fixing a vulnerability in a real organization is not clicking “update.” It first requires knowing which systems are affected, which means having a precise inventory of all software components in use, their versions, and their dependencies. Without this mapping, known as a Software Bill of Materials or SBOM, it is impossible to know whether a published vulnerability even applies. Then comes prioritization. Not all vulnerabilities are equal. Security researchers use a scale from 0 to 10, the CVSS score, to rate severity. But this score ignores context. A vulnerability rated 9 on a system isolated from the internet is less urgent than one rated 6 on an interface accessible to all your clients, typically your customer portal, mobile application, or partner platform. Real exposure is what matters, not the raw score.
The result of this complexity is documented: organizations remediate on average only 5 to 20% of their open vulnerabilities per month. The median time to fix a critical vulnerability exceeds 60 days. With more than 40,000 vulnerabilities recorded in the CVE registry, the global public catalogue that assigns a unique identifier to every known security flaw, in 2024 alone according to NIST, remediation capacity was already saturated before Mythos arrived.
Muhammad Yahya Patel, EMEA cybersecurity adviser at Huntress, was direct in Computing.co.uk on April 15, 2026: “Frontier AI cyber offensive capabilities are doubling every four months. The window businesses have to get their defenses in order is closing faster than anyone anticipated.”
What This Means for Regulated Entities
The CLUSIF flags in the same analysis the risk of a two-tier cybersecurity landscape: on one side, organizations integrating AI into their defensive practices; on the other, those waiting for market maturity, exposing themselves to a widening vulnerability window in the meantime.
For regulated entities, the obligations existed before Mythos. NIS2 Article 21 requires continuous vulnerability management. DORA requires resilience testing for financial entities. In 2025, 48% of ransomware attacks targeted mid-sized organizations according to ANSSI. What Mythos changes is the cost of non-compliance: a 60-day remediation window on a critical vulnerability, in an environment where autonomous exploitation costs the price of a business lunch, becomes an exposure that neither a NIS2 auditor nor a DORA supervisor will overlook.
The Campus Cyber, in its analysis note of May 7, 2026 drawing on two weeks of consultations with French CISOs, IT directors and auditors, describes the most concerning scenario: the imminent arrival of a widely accessible model capable of launching a global vulnerability discovery campaign across millions of critical systems, without patches being available at the same pace. Open source AI models of equivalent capability, potentially of Chinese origin, are considered plausible before the end of 2026.
Four Concrete Actions
- Know what you are running Build a precise inventory of your critical software components: everything touching authentication, customer data, financial flows, and business continuity. Your ERP, identity management system, banking interfaces, and messaging tools. Without this list, you cannot know whether a published vulnerability affects you.
- Prioritize by real exposure Focus resources on vulnerabilities affecting your externally facing interfaces, customer portals, mobile applications, partner platforms, before those affecting isolated internal systems, even if their raw severity score is higher.
- Test your absorption capacity Simulate a simultaneous remediation wave across ten or so critical components. The goal is to identify bottlenecks before they appear under real pressure. This is the central recommendation of the Campus Cyber note of May 2026.
- Set up real-time vulnerability monitoring Configure automated alerts on new CVE publications for your critical components, with immediate escalation to the CISO for remotely exploitable vulnerabilities. The window between publication of a vulnerability and the first exploitation attempt is now measured in hours, not weeks.
What Your Organization Should Take Away
Mythos did not create the problem. It removed the delay that was still protecting you. The real question for any executive is not technical: it is the gap between the speed at which your vulnerabilities can be found and exploited, and the speed at which your organization can fix them. Regulated entities that have mapped their dependencies, accelerated their patch management, and tested their response capacity will be those that understood early that the threat is not in the model. It is in that gap.
Sources : Mozilla and Anthropic, Firefox data, May 2026. Brian Grinstead, TechCrunch, May 7, 2026. UK AI Security Institute, Claude Mythos Preview cyber evaluation, April 15, 2026. Bloomsbury Intelligence and Security Institute, Mythos analysis, April 28, 2026. CNBC, May 8, 2026. Muhammad Yahya Patel, Huntress, Computing.co.uk, April 15, 2026. Campus Cyber, Mythos analysis note, May 7, 2026. CLUSIF, Mythos analysis, April 2026. ANSSI, Panorama de la cybermenace 2025. NIST, CVE registry 2024.
Stroople helps regulated organizations manage their cyber risk, from attack surface monitoring to outsourced CISO governance. Certified Expert Cyber by Cybermalveillance.gouv.fr.
Share:
External Attack Surface Management
See your exposure before attackers do. Know what's already compromised.
of successful breaches start from publicly exposed assets.
