Security has always been a race between the people finding flaws and the people fixing them. What changed recently is the clock speed. The window between a vulnerability being discovered and being weaponized has, in the words of the Cloud Security Alliance’s “Mythos-ready” framing, “collapsed to hours.” Defenders who still plan around weeks are planning around a tempo that no longer exists.
We’ve started calling this the Mythos era: the point at which AI can surface real, exploitable vulnerabilities at machine speed, and at machine scale.
What actually changed
For a while, the AI-and-security story was mostly noise. Bug bounty programs filled up with low-effort, speculative reports generated by models that had never confirmed anything they claimed. That problem hasn’t gone away.
But underneath the noise, something more consequential happened. As Sophos put it in a recent retrospective on its own bug bounty program, “frontier models are starting to produce validated, reproducible, exploitable vulnerabilities at machine speed.” The same write-up notes that Anthropic’s Claude Mythos has “discovered thousands of zero-days across major operating systems and browsers,” and that AI-assisted exercises have compressed days of reconnaissance into hours.
So defenders now face two things at once: a flood of AI-generated false signal, and a smaller but very real stream of AI-discovered true positives that move faster than any manual process was built to handle.
The volume is not abstract
You can see the pressure in the patch cycle. In its June 2026 Patch Tuesday, Microsoft shipped fixes for roughly 200 vulnerabilities, including six zero-days, one of which was already being actively exploited. That’s a single vendor, in a single month.
We’re not claiming any one patch cycle was “caused by AI” — attribution like that is rarely clean, and we’d rather under-claim than overstate. But the trend the numbers sit inside is hard to miss: more findings, surfaced faster, with a shorter runway between disclosure and exploitation. When the discovery side speeds up, the exposure window on the defending side gets more expensive by the day.
Why point-in-time testing isn’t enough on its own
The uncomfortable math of the Mythos era is an asymmetry. An attacker can now scan a broad attack surface, correlate it against known CVEs, and prototype an exploit on a timescale that used to require a skilled team and a calendar. A defender who tests once a year is leaving a blind window measured in months.
That doesn’t make penetration testing less valuable. It makes the shape of it matter more: how much surface you actually cover, how fast you separate real risk from noise, and how quickly you confirm that a fix actually held.
What to look for in a pen test now
The places where machine speed cuts both ways are the places to press a provider on.
-
Coverage at scale. Ask how reconnaissance, enumeration, fingerprinting, and CVE correlation are done across your full attack surface. Automation can cover ground a multi-week manual assessment would skip, and the same class of capability is already accelerating attackers.
-
Human review on every finding. This is the direct answer to the “slop” problem. Automation widens coverage; an experienced tester should validate every finding before it reaches your report. You want signal, not a triage queue.
-
Exploitable, business-critical risks first. The report should lead with the vulnerabilities that cause breaches, financial loss, or compliance violations, not low-impact findings that pad the page count and never get fixed.
-
Re-validation built in. Ask whether retesting your fixes is included. When the exposure window is the whole game, confirming a fix actually held should be part of the engagement, not an upsell.
The goal isn’t to out-compute the attackers. It’s to make sure that when AI is finding flaws at machine speed, your defenses have been tested at something close to the same tempo — by people who can tell a real exploit from a confident-sounding hallucination.
The takeaway
The Mythos era doesn’t change what good security looks like. It changes how quickly you have to get there. If your last real test of how your defenses hold up was measured in quarters, the gap between “discovered” and “exploited” is no longer on your side.
Sources
- Sophos, Bug Bounties in the Mythos Era — sophos.com
- BleepingComputer, Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws (June 9, 2026) — bleepingcomputer.com