Topic starter
10/07/2026 9:13 pm
TL;DR: Anthropic’s Project Glasswing showed that its Claude Mythos Preview model could chain multiple vulnerabilities into working exploit paths, scoring 83.1% on CyberGym and finding thousands of high-severity flaws, according to JupiterOne’s analysis of the announcement. The real shift is that security teams must now govern asset context and exploit chains, not just CVSS severity.
Editorial analysis by NHI Mgmt Group, based on content published by JupiterOne: “Project Glasswing Proves That "Just Patch the Criticals" Is Dead. Here's What Comes Next.”.
By the numbers:
- Claude Mythos Preview scored 83.1% on CyberGym’s vulnerability reproduction benchmark.
Key questions
Q: What breaks when security teams only patch the criticals?
A: Patch-only triage fails when attackers can chain several lower-severity issues into one exploit path.
Q: Why do connected identities change vulnerability severity?
A: Because the identity attached to an asset determines what an attacker can reach after exploitation.
Q: What are the signs that vulnerability management is missing exploit chains?
A: The main signs are long backlogs of medium-severity issues, flat CVE dashboards with no relationship data, and patch decisions made without understanding connectivity or permissions.
Practitioner guidance
- Map exploit paths, not just CVEs Model how vulnerabilities, identities, and network reachability combine into specific compromise paths, then prioritise the links that create the shortest route to high-value systems.
- Inventory privileged service accounts with reachability Identify which service accounts, workload identities, and automation credentials can move from exposed systems into production environments or sensitive data stores.
- Re-rank patch queues by blast radius Use asset criticality, connectivity, and reachable permissions to move beyond CVSS-only triage and focus first on flaws that sit on connected attack paths.
Bottom line: AI-driven chaining makes isolated vulnerability scores an incomplete basis for remediation because exploitability now depends on how flaws connect.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:35 pm
Patch-only vulnerability management is now a broken operating assumption: Security teams built their prioritisation models around the idea that one flaw maps to one remediation decision. Project Glasswing shows that exploitability is increasingly combinational, not singular. A medium issue can become the enabling link in a chain, so the control problem is path visibility, not just patch velocity.
A question worth separating out:
Q: What should teams do when AI agents become part of the attack surface?
A: Treat AI agents as non-human identities with explicit ownership, permissions, and data paths. Then review whether any agent can access systems or secrets that would turn a compromise into broader exposure. If the answer is unclear, the agent is already part of your attack surface and needs governance immediately.
👉 Read our full editorial: AI agent attack chains make patch-only vulnerability management obsolete