Navigating the 'new normal': AI-powered exploits and discovery

Since the launch of Anthropic's Mythos, the focus on the risks that AI-powered tools pose for security teams has escalated. The shift, however, lies in the increased speed and scale of potential attacks. AI swiftly uncovers more vulnerabilities than ever before, leaving security teams with reduced response windows.

This situation necessitates a new approach to exposure management, emphasizing the importance of solutions that enable security and IT teams to stay secure. The Project Glasswing update demonstrated Mythos's capabilities, leading to the identification of more than 10,000 high and critical severity vulnerabilities within a month.

With 6,202 estimated high/critical vulnerabilities found across more than 1,000 open-source projects, Mythos is a game-changer, but the gap between attackers and defenders has been widening for some time.

Security teams have been grappling with a growing volume of CVEs, reaching 48,185 in 2025—an increase of 20.6% from the previous year. The impact of AI is palpable, as its capabilities continue to fuel the trend of complex, novel attacks. As a result, the number and frequency of these attacks are set to rise significantly in the coming years.

Restricting access to powerful models like Mythos is not a viable solution. Our research has shown that even general access LLMs, when prompted by experienced security practitioners, can find and exploit novel vulnerabilities autonomously. An automated vulnerability research pipeline, created without human intervention, discovered a remote, multi-stage SQL injection vulnerability affecting 300,000 WordPress plugins. This finding was later confirmed by an independent researcher and assigned CVE 2026 3985.

The real danger lies in AI-powered attacks taking automation a step further. An autonomous agent can create and send an exploit, demand ransom, and even harvest credentials, move laterally, and encrypt data—all without human intervention. This highlights the need for security teams to adopt proactive measures, such as attack surface reduction.

Exposure management should be a primary focus, as leaving unnecessary internet-facing assets exposed can make targets easy prey for automated, high-speed attacks. Stripping away exposed services, like a MySQL database or private API documentation, may seem like a simple solution, but it significantly reduces the risk of becoming a victim of these emerging threats.