How do you defend when the time between patch and exploit collapses?

Anthropic's Claude Mythos has demonstrated that AI can be leveraged to identify vulnerabilities and develop exploits faster than ever. Here is what that means for how you defend.

The model that security has operated on for 30 years

The logic of enterprise security has always been an arms race. Researchers find vulnerabilities, publish CVEs, vendors release patches, and defenders deploy them before attackers can build working exploits. The exploitation window, the gap between disclosure and weaponized attack, was measured in weeks. Sometimes months. Long enough for patch management cycles to close the gap on critical systems.

That window is what every patch-first security program is built around. Security teams were operating on the assumption that they had time.

Once Claude Mythos or equivalent models are widely available, that assumption is no longer valid.

What Claude Mythos actually demonstrated

On April 7, 2026, Anthropic announced Project Glasswing, a collaborative effort between Anthropic and AWS, Apple, Cisco, CrowdStrike, Google, Microsoft, NVIDIA, and others, leveraging artificial intelligence to discover vulnerabilities at scale. All partners of Project Glasswing will get access to Claude Mythos Preview, which Anthropic claims can outperform all but the best human hackers in discovering and exploiting software vulnerabilities.

The technical results Anthropic published are worth reading carefully, because they are not marketing claims; they are reproducible research outcomes that describe what Claude Mythos can do right now:

• A working remote-code-execution exploit against a major operating system, with a relatively low compute cost. For a $20,000 investment in code scanning, Anthropic uncovered various findings, and the cost associated with one specific vulnerability was $50.
• A chained privilege escalation sequence against Linux: under $2,000.
• A 27-year-old flaw in OpenBSD, missed by every prior analysis tool: found autonomously.
• A 16-year-old vulnerability in video processing code that had been tested five million times by automated tools: found in hours.

Anthropic's own technical report states that over 99% of the vulnerabilities Claude Mythos has found are currently unpatched. Project Glasswing is a defensive initiative (the model is restricted to a closed consortium specifically to prevent offensive weaponization). But the capability Claude Mythos demonstrates is not unique to Anthropic. Nation-state actors and well-funded adversaries are developing parallel capabilities. The defenders inside the Glasswing consortium will close some vulnerabilities before attackers find them. They will not close all of them.

The new math: Why assume-breach is now arithmetic

Here is the honest version of your organization's current security posture:

Your infrastructure runs on software containing thousands of as-yet-undiscovered vulnerabilities. Some of those vulnerabilities are decades old. AI-assisted discovery is now systematically finding them. Patching at the rate they're being found isn't operationally feasible. The remediation capacity of every enterprise security team is finite, and the discovery pipeline is now at machine scale.

This is not a failure of your security team. It is the structural consequence of 30 years of accumulated software complexity meeting a step-change in offensive AI capability.

The correct response is not "patch faster". The correct response is to build a security program that is explicitly designed around the assumption that you will be breached. One that measures its success by how quickly and completely you detect and contain the breach, not whether it happened.

What assume-breach actually requires

An assume-breach security model has three operational requirements:

1. Detect post-breach behavior before it escalates. An attacker inside your network will evade defenses, including endpoint detection and response (EDR) systems, move laterally, establish command-and-control (C2), and stage data for exfiltration. Each of these activities has a behavioral signature. Your detection capability needs to catch these behaviors in near-real time with AI-powered defense.
2. Reconstruct the complete attack chain. In the event of an incident, forensic evidence should provide a complete picture of the incident from the point of initial entry, the lateral movement route taken, the command and control channels utilized, staging, and exfiltration activities.
3. Contain rapidly to limit the blast radius. Mean time to detection (MTTD) and mean time to respond (MTTR) are no longer secondary metrics; they are the primary measure of your security program's effectiveness. Every hour of dwell time is potential lateral spread, additional data access, and compounding remediation cost. Automation of the entire workflow can accelerate containment.

These requirements point to a common dependency. You need visibility into what is happening on your network, not just on your endpoints, not just in your logs, but in the actual traffic in your infrastructure.

Why the network is the right detection layer

AI-accelerated attacks will be faster and more automated than current threats. The techniques that matter most lateral movement, C2 establishment, data exfiltration) will increasingly use legitimate protocols and system tools to avoid triggering EDR alerts. These living off the land (LOTL) techniques will be leveraged by AI-assisted attackers with a precision and speed that manual adversaries cannot match.

Regardless of which endpoint tools they disable, which logs they delete, or which legitimate system binaries they abuse, their activity produces network traffic. That traffic cannot be retroactively altered when it is passively captured and stored.

Corelight’s network evidence is based on Zeek®, the open-source network analysis engine deployed across more than 10,000 organizations worldwide. Corelight Open NDR parses that traffic into structured, protocol-rich evidence: conn.log captures every connection; dns.log captures every resolution; ssl.log captures certificate details; http.log captures every request and response. These logs provide the data to establish a behavioral baseline that makes anomaly detection meaningful and the forensic record that completes incident reconstruction.

Anomalies in the certificate used to establish a C2 connection through HTTPS will be recorded by ssl.log. The lateral movement of the attacker through the network using stolen credentials via SMB is logged by conn.log at each step. When data is staged for exfiltration over DNS, dns.log captures the query volume and entropy that signals tunneling.

Endpoint agents see what happens on individual hosts. Network evidence shows how an attacker got there, where they went next, and what they took. Only network evidence captures ground truth data, regardless of whether attackers are hitting managed systems.

What changes operationally right now

You do not need to wait for AI-powered attacks to become widespread before adjusting your security operations. The structural shift is already underway, and several changes are warranted immediately:

• Reprioritize your metrics. Treat MTTD and MTTR as primary board-level metrics. If your current security program cannot tell you these numbers with confidence, that is the gap to close first.
• Assess your post-breach detection capability. Detection of lateral movement and command & control requires behavioral analytics of network and cloud flows, not endpoint data alone. If your network visibility is based solely on firewall logs and NetFlow data, you are ignoring the critical behavioral signal for post-breach detection.
• Verify your forensic evidence chain. When an incident occurs, your team needs to reconstruct the full attack chain in hours, not days. Right packet capture with intelligent retention (capturing the packets that matter, not everything) makes that possible without prohibitive storage costs.
• Automate your investigation workflow. Humans cannot manually triage at the velocity that AI-accelerated attacks will generate alerts. Automated correlation, entity-centric investigation workflows, and agentic triage are operational necessities, not items on the future roadmap.
• Automate remediation workflows. This includes patching, deployment, and rollback.
• Continue to adopt cybersecurity best practices: Just because new tools are being developed does not imply that frameworks such as Zero Trust, which advocate for segmentation, robust identity management, and data security, will become obsolete.

Our view on Project Glasswing: What it gets right

Anthropic made the right call in structuring Glasswing as a closed consortium rather than making Claude Mythos preview widely available. A model that can quickly generate working RCE exploits should be made available responsibly. The decision to restrict access while accelerating defensive patching reflects a genuine attempt to shift the balance of power between attackers and defenders before the capability proliferates.

By design, the Glasswing consortium addresses the problem of vulnerability discovery and patching. What it does not (and cannot) address is what happens after an attacker exploits a vulnerability that hasn't yet been patched. With 99% of Claude Mythos's findings currently unpatched, that gap is not theoretical.

Corelight's view: Project Glasswing is an important defensive initiative that should accelerate every organization's investment in detection and response capabilities, as well as automated vulnerability remediation. The Glasswing consortium is attempting to secure the software supply chain, and should help blunt the negative impact of Mythos-class models in the hands of attackers. However, it will certainly not identify or prevent every future vulnerability. Organizations need to prepare for a world of highly automated vulnerability discovery and exploitation by using a variety of tactics. Among them, certainly, is a commitment to gathering the highest-quality real-time data from their networks to feed future AI-automation and remediation workflows.

The bottom line

AI-powered vulnerability discovery and exploit automation have changed the security calculus. Security operations workflows built on the assumption that exploitation windows are measured in weeks operate under a model that no longer reflects the threat environment.

The security posture needs to be built around detection, investigation, and containment velocity—not breach-prevention rate. That requires complete network visibility, behavioral analytics that catch post-breach activity before it escalates, and forensic evidence chains that support full attack reconstruction. Automated remediation is essential, and leveraging LLMs may be necessary for SOC leaders to reduce mean time to respond.

If exploitation drops to a trivial cost, and 99% of discovered vulnerabilities remain unpatched, a breach is a near-certainty for any organization that an attacker is motivated to target. The question is not whether you will be breached. The question is whether you will detect it in time to contain it.