When AI begins automatically discovering vulnerabilities: after Mythos, cybersecurity is entering the era of “coordinated offense and defense”

When AI Begins Automatically Discovering Vulnerabilities: After Mythos, Cybersecurity Is Entering the Era of “Co-Production in Offense and Defense”

Over the past decade, the core logic of enterprise security has been to build defenses around “known threats”: better logs, faster response, more complete vulnerability management, stricter access control. But after frontier AI began entering vulnerability discovery, code analysis, and security assessment, this logic is starting to break down. The changes facing the security industry are not simply the addition of another tool; rather, the speed structure of threat generation, vulnerability mining, and defense validation is being rewritten.

According to CSO Online, at the Infosecurity Europe conference in London, industry experts warned enterprise security teams to prepare for the next wave of impact from frontier AI models. Anthropic is expanding its Project Glasswing program to give more vetted organizations access to Claude Mythos; meanwhile, OpenAI has also reportedly offered its cybersecurity tools to several major banks in the UK. On the surface, these moves look like vendors expanding enterprise pilot programs, but from an industry perspective, they signal a deeper shift: AI is moving from “helping humans do security” into the stage of “reconstructing security itself.”

Vulnerability Discovery Is Being Modeled

For a long time, the security industry has relied on the experience of specialists, toolchains, and manual judgment. Whether it is penetration testing or vulnerability prioritization, both essentially require heavy human labor. The addition of frontier AI models is changing every link in this chain.

Anthropic’s Mythos is being seen by the industry as a structural signal: it may not only help discover vulnerabilities, but also, with broader code understanding, stronger behavioral analysis, and a higher degree of automation, identify risk paths that traditional testing often misses. The report mentions that Mythos may even make it easier to “chain together” multiple medium-severity vulnerabilities into a high-impact risk. This is crucial, because real-world attacks often do not rely on a single fatal flaw, but on the compounding of multiple seemingly minor issues.

This means security teams are no longer facing just individual CVEs or isolated patches, but the dynamic threat of “vulnerability combinations.” Traditional vulnerability scoring systems are beginning to look cumbersome here: a single vulnerability may not be severe, but within an attack chain, its value can be amplified by the model. In other words, AI is not only speeding up discovery; it is also changing the economics of vulnerabilities themselves.

On the Defense Side, the Advantage Is Coming from “Scaled Confrontation”From the defender’s perspective, frontier AI is not just a source of risk; it can also be a tool for shifting costs. A relevant official from the UK National Cyber Security Centre (NCSC) pointed out at the conference that organizations can use AI to write code better, find vulnerabilities, and impose more costs on attackers. The meaning behind this statement is very practical: if attackers can use AI to enumerate assets faster, find weaknesses, and generate attack chains, then defenders must also use similarly scaled automation to validate, classify, remediate, and retest.

This will push enterprise security from “labor-intensive response” toward “machine-assisted continuous confrontation.” Security teams are no longer just the department that handles incidents after they occur; they need to operate like engineering teams, continuously performing verification, regression testing, and risk prioritization. The hardening access controls and incident response exercises mentioned in the report also show that basic security capabilities remain important, but their meaning has changed: they are no longer compliance items on a best-practices checklist, but the minimum conditions for survival in the AI era.

Why “son of Mythos” is worth paying attention to

Cobalt CTO Gunter Ollmann used the phrase “son of Mythos” at the conference to describe a new generation of frontier AI security tools that may emerge next. This is not rhetorical exaggeration, but an assessment of the industry’s pace of evolution: when the first generation of tools has only just been opened up in a limited way, the next generation is often already on the way, and it will be cheaper, easier to use, and more widely adopted.

This will impact the security industry on two levels.

First, capability diffusion. Frontier security models that today require strict approval, whitelisting, and partner relationships to access may in the future spread more broadly to more enterprises, outsourcing teams, and even the wider attacker ecosystem at a lower barrier to entry.

Second, acceleration of pace. The iteration cycle for security products is already slower than that of attackers, and when the models themselves begin to rewrite the speed of vulnerability discovery, enterprise patching, auditing, and retesting processes will be forced to speed up. What is truly alarming here is not any single model, but the formation of “model-driven continuous competition”; once that happens, any organization that does not enter this curve will quickly fall behind in capability.

Traditional threat modeling is losing certainty

The relevant views from the Cloud Security Alliance also reveal a deeper shift: when multiple vulnerabilities can be automatically chained together, the relatively stable “map of known weaknesses” in traditional threat modeling starts to lose certainty. In the past, enterprises could assume they had identified most of the critical risks and build defenses around them; but in an AI-assisted vulnerability discovery environment, that assumption is becoming increasingly fragile.This does not mean that vulnerability scoring systems are completely obsolete; rather, their centrality is declining. Enterprises need to move from “vulnerability management” to “attack path management,” and from “patching” to “controllability of exploitability.” This also explains why more and more security discussions are emphasizing identity controls, least privilege, access boundaries, and response drills, rather than just scan results.

The security industry is moving from a tools market to a model market

If we place this event in the broader landscape of the technology industry, it becomes clear that the security sector is undergoing a platform shift. In the past, the security market consisted of a large number of vertical tools: scanners, WAFs, EDR, SIEM, ASM, penetration testing services, each solving one part of the chain. But the emergence of frontier AI models is causing these capabilities to begin concentrating at the general-purpose model layer.

This brings two consequences.

First, security capabilities may be “foundation-modelized.” Models like Claude and GPT may not necessarily replace specialized security products, but they will absorb some of the high-frequency, standardized, and reusable analytical work.

Second, security startups must redefine differentiation. Future competition will not just be about “whose vulnerability database is more complete,” but about who can connect model capabilities with enterprise environments, compliance boundaries, incident response workflows, and real validation scenarios. In other words, if a startup lacks a data feedback loop and workflow integration, it will be easily squeezed by model platforms.

For enterprises, this is not a pilot issue, but a governance issue

Many enterprises may view frontier AI security tools as an optional pilot: let the red team try them, let the security team run them first, observe the results in a limited environment. But this mindset underestimates the depth of the change. AI entering vulnerability discovery and security operations means enterprises must redesign their governance framework: who can access the model, how data is isolated, how generated results are verified, who is responsible for false positives and false negatives, and whether model suggestions can go directly into production remediation workflows.

These issues have, in essence, moved beyond procurement and into the realm of technical governance and responsibility allocation. Especially in finance, critical infrastructure, and large cloud environments, once model outputs enter the security decision chain, they will bring new compliance and audit requirements.

The bigger trend: AI is turning “security” into an infrastructure race

From the perspective of global technology competition, the spread of these frontier security models is not just an enterprise software upgrade, but a competition involving compute, models, data, and security processes. Whoever can embed AI earlier into vulnerability discovery, code review, identity management, and response automation is more likely to gain an advantage on the future security cost curve.

At the same time, AI security capabilities will in turn affect the cloud computing, chip, and enterprise software markets. More complex models mean greater inference demand, larger compute costs, and stronger infrastructure lock-in; and once these capabilities become a normal part of enterprise security, model providers will no longer be just application-layer vendors, but will move more deeply into the core of the enterprise technology stack.This is also why the phrase “son of Mythos” carries symbolic meaning: it points not to a specific product, but to the eve of a new order. In this order, offense and defense are no longer a contest between humans and tools, but a continuous competition driven by models. For enterprises, the question is no longer whether to use AI, but how to upgrade their defense systems to the same speed before AI-armed attackers arrive.

Conclusion

Frontier AI is pushing cybersecurity from an industry centered on experience and rules toward one centered on models, compute, and continuous validation. The moves by Anthropic and OpenAI are only the beginning. What is truly worth watching is not whether a particular model is stronger, but whether the industry’s underlying assumptions still hold.

If vulnerability discovery, attack-chain construction, and security validation all begin to be accelerated by AI, then enterprises, regulators, and security service providers will be facing not “more threats,” but “faster reality.” In such an environment, what falls behind is not the tool, but the organization’s understanding of speed.

SEO Description Frontier AI is entering the core stages of vulnerability discovery and security operations. This article analyzes Anthropic Mythos, OpenAI cyber tools, attack-chain automation, enterprise defense upgrades, and the restructuring of the cybersecurity industry, discussing how AI is changing vulnerability management, red-team testing, compliance governance, and global tech competition.

Source URL https://www.csoonline.com/article/4180920/beware-the-son-of-mythos-security-experts-warn.html