Mythos access is expanding: what this means for vulnerability management
Get security briefings from the Threat Research Team
New campaigns, attacker techniques, and detection guidance — straight to your inbox.
Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered.
Anthropic’s Claude Mythos put vulnerability management in the boardroom when it was released earlier this year, and the conversation around it has evolved. Press coverage continues to find new angles, and there’s plenty of discourse around how AI is changing everything about cybersecurity.
In the months since the initial release of Mythos Preview, there have been a few developments around what Mythos can do and who is able to access it. But what does this actually mean for your vulnerability management program?
A stronger model, wider access
In September, Anthropic shipped Claude Mythos 5.1, which it calls the model with the strongest cyber capabilities of any they’ve released. Mythos 5.1 is built on the same base model as the generally available Fable 5.1 with different safeguards attached. Then, in October, it folded Project Glasswing, the early-access program that gave select critical infrastructure providers and industry partners access to Mythos, into an expanded tiered Cyber Verification Program (CVP). The revamped CVP spans everyday defensive work up through the highest-sensitivity critical infrastructure.
This means that compared to at launch, machine-speed vulnerability discovery that used to be limited to a small group will reach a wider set of defenders. According to Anthropic, Glasswing partners turned up more than 129,000 verified vulnerabilities between April and July, over 33,000 of them critical or high severity. More access to Mythos-class discovery sounds like it should mean more vulnerabilities found, faster, across more organizations. While this is true, that large number isn’t the full story.
Discovery and exploitation aren’t the same thing
Anthropic noted in its announcement that the generally available Fable 5.1 can now be used to discover software vulnerabilities, but explicitly not to develop exploits for them. Activities that could be used maliciously like penetration testing, exploit generation, etc., are redirected to lower-tier models. The same gating carries into Mythos. The CVP’s three access tiers wall off penetration testing and red teaming work behind the two highest, most heavily vetted tiers.
So while broader access to Mythos-class capability means broader access to finding things faster, it doesn’t, by itself, mean broader access to attacking anything. Also, Mythos still isn’t broadly available: access runs through vetted organizations in the CVP, so it isn’t something readily on hand for attackers.
That’s not to say automated attacks aren’t happening, but that’s a separate development, not something that traces back to Mythos specifically. Lumping every agentic AI risk together misses where the actual exposure is coming from.
The core of vulnerability management hasn’t changed
A lot of the coverage of Mythos makes it sound scarier than it needs to. While it does make vulnerability discovery significantly faster, no security team was patching every known CVE even before Mythos existed. Using AI agents for defense can increase teams’ speed and scope, but the real differentiator continues to be knowing which findings are in active, loaded packages, reachable, and creating real risk, versus which ones are noise with a scary CVSS score attached.
Exploits are getting faster too. Mandiant now puts the average time-to-exploit at negative seven days, meaning exploitation begins before a vulnerability is even disclosed. This makes it even more important to build a vulnerability management program around core principles.
The fundamentals of vulnerability management are even more important in the AI discovery era:
- Scan and discover everything in one place, CVE and non-CVE findings alike.
- Prioritize by what’s in-use and exploitable, not just what scores high.
- Automate remediation at the source instead of patching every downstream instance individually.
- Treat runtime security as a safety net for whatever stays exposed.
This plan for vulnerability response doesn’t get rewritten because discovery got faster. Agentic AI can be utilized on your side too, automating and accelerating each of these steps and helping keep up with the volume of findings. You don’t need to treat every Mythos headline as a crisis or rebuild your program every time access expands again.
Learn more at the webinar
To learn more about building a Mythos-ready vulnerability management program, join our webinar, Mythos Decoded: What’s Actually Changed in Vulnerability Management. We’ll cover what Mythos actually is and isn’t and practical steps to keep pace with AI-accelerated discovery without the panic.