The AI That Finds Bugs Is About to Go Public. Are Your Systems Ready?
Why the coming wave of AI vulnerability discovery makes patching a survival skill for small and midsized businesses
Executive Summary
Anthropic has confirmed that its most capable security model, known as Mythos, will reach the general public in the coming weeks. Until now that capability has been limited to a small group of large platforms. Soon anyone can use it, including the people trying to break into your systems. These models read software, find the weaknesses in it, and write working attacks against them with little human help. The same capability that helps a defender fix a flaw helps an attacker exploit it, and attackers usually move first.
This is not a reason to panic. It is a reason to do the unglamorous work most breaches still depend on. Verizon’s most recent Data Breach Investigations Report found that exploiting software vulnerabilities is now the single most common way breaches begin, ahead of stolen passwords for the first time in the report’s nineteen year history. The businesses that get hurt are rarely the ones with the smallest budgets. They are the ones that were not patching consistently and were not watching their internet facing systems closely. If you do not have a vulnerability management and patching program that someone actually runs every month, the window to fix that is closing. Start with the systems exposed to the internet, and do not ignore the internal ones.
What Is Actually Happening
Anthropic introduced Mythos earlier this year as a model built specifically for cybersecurity work. It can analyze software, identify previously unknown vulnerabilities, and in some cases build the exploits that take advantage of them. Because of how powerful that is, the company held it back and gave early access only to a small set of large platforms and security vendors through a program called Project Glasswing. During that limited preview, the model reportedly helped find more than ten thousand critical software vulnerabilities.
That restriction is now ending. Anthropic expects to make Mythos class models available to all of its customers within weeks, once additional safeguards are in place. There is a genuine upside, because defenders can use the same tools to close flaws before attackers reach them. But the company itself has acknowledged the near term risk. When powerful capability is released, attackers are often the ones who use it first, simply because they have less to lose and fewer rules to follow.
Why This Lands Hard on Vulnerabilities
Verizon’s annual Data Breach Investigations Report is one of the most respected sources of breach data in the industry. Its most recent edition found that exploiting software vulnerabilities has become the leading way breaches begin, involved in roughly a third of them, beating stolen passwords for the first time in nineteen years. Two findings from that research are worth sitting with:
- Internet facing systems are the favorite target. Firewalls, VPNs, and remote access gateways, the equipment that sits at the edge of your network by design, are a primary focus for attackers, because anyone on the internet can reach them.
- Patching is falling behind. Only about a quarter of known, actively exploited flaws were fully fixed in the most recent year, down from the year before, while the typical time to resolve a serious flaw grew past six weeks and the number of critical flaws jumped by half.
Now add the new variable. The report warned that AI assistance is compressing the gap between a vulnerability becoming public and being attacked, from months to hours in some cases. A program that takes six weeks to patch a critical flaw was already exposed. Against an attacker moving in hours, six weeks is not a response time. It is an open door.
Why Small and Midsized Businesses Should Pay Attention
It is tempting to assume this is a problem for large enterprises with famous names. The opposite is closer to the truth. Attackers using automated tools do not pick targets the way a burglar cases a specific house. They scan broadly for any system with a known weakness left unpatched. A small manufacturer, a regional accounting firm, and a forty person logistics company all look the same to a scanner. If the door is unlocked, the size of the building does not matter.
Smaller organizations are often more exposed for reasons that have nothing to do with carelessness. Lean teams mean the people responsible for patching are responsible for ten other things too. Aging equipment may no longer receive updates, or may run a version with a flaw that is now public knowledge. And many organizations cannot confidently answer a basic question: what do we have exposed to the internet right now, and is it current? None of this requires an enterprise budget to fix. It requires a routine, an owner, and the discipline to follow it.
What a Working Program Actually Looks Like
Vulnerability management has a reputation for being complicated. At the level that matters for most businesses, it comes down to four habits performed consistently.
- Know what you have. Keep a current inventory of systems and software, with particular attention to anything reachable from the internet. That list changes more often than people expect, so it has to be revisited, not filed away. You cannot patch what you do not know you have.
- Scan regularly, not occasionally. A vulnerability scan checks your systems and reports known weaknesses. A scan you ran six months ago describes a world that no longer exists. Scanning needs to be continuous, so a newly exposed weakness is noticed in days rather than found by an attacker first.
- Prioritize by real risk, not raw counts. The goal is not a smaller number on a dashboard. It is closing the doors attackers are most likely to use. Fix internet facing and actively exploited flaws first, then work inward. A medium severity flaw the whole internet can reach is more urgent than a severe flaw on an isolated internal machine, but do not pretend internal systems are safe, because that is where attackers go once they are inside.
- Patch on a schedule you keep. Perfect patching is unrealistic for anyone. Predictable patching is not. Build patching into the monthly rhythm of the business the same way you close the books, and the worst exposures stop lingering for weeks.
The Takeaway
A powerful, publicly available tool for finding and exploiting software flaws is weeks away, at the same moment that exploiting those flaws has become the most common way breaches begin and patching has been losing the race. This does not change the fundamentals of security. It raises the cost of ignoring them. In skilled hands the same technology will make good defenders faster, and over time that favors the side that maintains its systems well.
So know what you have exposed, scan it continuously, fix the internet facing and actively exploited problems first, and do not leave your internal systems unguarded behind them. Run all of it on a schedule you actually keep, because the attackers are no longer keeping a slow one.
