More than 10,000 critical vulnerabilities detected in one month: what Anthropic’s Project Glasswing has just revealed should change the roadmap for all CISOs.
Since April, all the CISOs I meet have asked me the same question: which AI security tool should I buy to respond to Mythos? That’s the wrong question. The right question would be whether the foundations on which these tools rest can withstand what happens.
Anthropic’s Project Glasswing, which gave its partners early access to Mythos, discovered more than 10,000 high or critical vulnerabilities in a month. Anthropic warns that competing laboratories could publish comparable models within six to twelve months, without necessarily the same safeguards.
We cannot just make corrections as we go along. The companies that survive this complicated period will be those that have put in place what should have been there a long time ago: a reduced attack surface, real-time visibility, automated remediation and a single source of truth shared between security and IT.
Reduce the attack surface
Mythos detects flaws in code that has sometimes remained unchanged for decades. Every application, every port, every service that runs without the company really needing it is a free target. Reducing risk isn’t about fixing more vulnerabilities, it’s about having fewer things to exploit.
Most environments have a considerable amount of unnecessary space lying around: software installed for completed projects, ports left open due to lack of certainty about what they depend on, extensions and administration tools without an identified owner. Mythos will find the fault in what actually runs, not what your asset inventory claims to run.
It is necessary to carry out a real-time inventory of each terminal, assign a business owner for each application, establish a clearly established dependency for each open port. Remove what’s not needed, lock what is, segment the rest. This is not a new recommendation, it is simply no longer optional.
Patch management is part of the answer, it is not the whole answer
Long before Mythos, the Edgescan report 2025 indicated that 45% of vulnerabilities in large companies worldwide remained unpatched after twelve months. It’s not a bottleneck problem, it’s a choice. The results of Project Glasswing confirm this: out of 1,094 critical flaws confirmed in open source projects, only 97 were fixed.
Most correction programs are based on long sequential stages: preparation, test deployment, waiting for results, review, planning for the next wave, deployment, validation. Each step is manual and relies on inventory data that is several days or weeks old.
AI will make the situation worse. Project Glasswing partners already use Mythos to write patches, which speeds up their writing but amplifies the deployment problem: more patches generated faster means a longer queue to an unchanged pipeline. The bottleneck shifts to the platform responsible for pushing them and providing proof on each terminal.
Many systems simply cannot be corrected: end of life, OT, embedded firmware, third-party software awaiting a publisher patch. The answer remains the same: visibility, segmentation, compensatory measures. We must reduce patching SLAs from thirty days to a few hours, reserve human validation for high-impact changes, and automate the rest.
No longer drowning in alerts
AI-powered defense tools will also flood your alert queues. The real question is whether you can identify what really matters this week. The CVSS score alone will not be enough: a critical flaw in an isolated test environment does not have the same weight as an average flaw on your payment system. Treating both the same means exhausting your teams chasing noise while the real risks thrive.
It is necessary to prioritize according to the criticality of the assets, the business context, the availability of an exploit and the actual exposure path, relying on a single and authoritative data source rather than reconstituted between a dozen consoles, where the data expires or silently contradicts itself.
Vendors will tell you that the answer to Mythos is even more AI layered on top of existing tools. This is sometimes true. But more often than not, it’s just another layer on a foundation never designed to support it.
Mythos did not invent new problems. It made it impossible to continue postponing the old ones. Companies that come through this period intact will have used the next twelve months to finish what they started: reduced attack surface, real-time visibility, automated remediation, and a single source of truth shared between security and IT.
