CSA/SANS briefing: building a "Mythos-ready" security program for AI-found vulnerabilities

In two minutes

• The authors expect Anthropic's Mythos and Project Glasswing to start many waves of AI-found vulnerabilities, with attackers gaining an asymmetric benefit because patching has inherent limits (p. 5).
• They say Mythos-class capabilities will spread to other frontier models within months and to open-weight models within six months to a year (p. 10).
• The first moves are to point LLM agents at your own code and pipelines, require AI agent adoption in security teams, and secure those agents, since existing controls do not cover them (pp. 19-20).
• The plan holds that basic controls still matter: segmentation, egress filtering, phishing-resistant MFA, dependency control, and inventory (pp. 20-21).
• The briefing gives a draft risk register of 13 risks (5 labeled critical, 7 high, 1 medium) and 11 priority actions with start dates and completion horizons (pp. 16-21).
• It asks CISOs to update risk metrics, run tabletop exercises for several simultaneous major incidents, and ask for reserve headcount to avoid burnout (pp. 6-7).
• Section V offers board talking points and a 90-day plan covering people, AI tooling, hardening, governance, playbooks, and progress tracking (pp. 22-23).
• The authors say the timetable is aggressive and may be unrealistic for some organizations, and that some recommendations conflict, such as patch cooldowns versus faster patching (p. 19).

Key numbers

• 181 vs 2: Working Firefox exploits generated by Mythos versus Claude Opus 4.6 in Anthropic internal lab tests (p. 10).
• 72%: Exploit success rate attributed to Claude Mythos Preview in the timeline (p. 12).
• 40 vendors: Vendors in the early access program whose patches may arrive in a deluge (p. 13).
• 500+: High-severity open source vulnerabilities reported by Anthropic using Claude Opus 4.6 (p. 11).
• 54 vulnerabilities in four hours, 54 million lines of code: DARPA AIxCC finals result (p. 11).
• 8 minutes: Time for an AI-based attack documented by Sysdig to reach admin-level access (p. 11).
• 2 to 10 per week: Rise in Linux kernel bug reports, now all verified as real (p. 11).
• 45 days / 90 days / 6 months / 12 months: Completion horizons in the priority action table (pp. 19-21).

What to do with it

• Ask an agent for a security review of your code this week, then build toward LLM-driven review of all code before merge in CI/CD (p. 19).
• Formalize AI agent use across security functions, and set scope limits, blast-radius limits, escalation logic and human override before agents touch production (pp. 19-20).
• Prepare triage and deployment capacity for a flood of patches, and run tabletops for multiple high-severity incidents in one week (pp. 6, 20).
• Update risk metrics and reporting to AI-accelerated exploit timelines, and tell stakeholders why (pp. 6, 20).
• Verify segmentation, egress filtering, phishing-resistant MFA for privileged accounts, and dependency lockdown, and start a continuously updated inventory (pp. 20-21).
• Use the 10 questions on p. 15 to test where your program stands, then use the Section V talking points for a board request covering headcount and faster procurement (pp. 22-23).

Read the full document if

• you need a ready-made action plan and board framing for AI-driven vulnerability discovery
• you want the draft risk register mapped to NIST CSF 2.0, OWASP and MITRE ATLAS codes
• you are deciding how to staff and govern AI agent adoption in your security team

What it relies on

The briefing rests on the authors' and reviewers' judgment, not on a new dataset. Its figures come from third-party announcements and reports cited in a timeline (pp. 10-12, 25), such as Anthropic's lab tests and the Zero Day Clock. It does not describe a method for assigning the severity labels in the risk register. The lead authors are the CEO of Knostic and the Chief AI Officer of SANS. Knostic's OpenAnt tool is listed among the recommended tools (p. 19), and Anthropic and OpenAI products are also named. The document is version 0.95, marked draft in places, and authors speak for themselves, not their employers.

Our read

Useful as a checklist and a board-conversation starter on AI-accelerated vulnerability risk. It is a consensus briefing with a draft risk register, so treat the dates and severity labels as starting points to adapt, not as measured results. Its capability claims come from vendor and researcher announcements.