Topic starter
02/06/2026 8:48 pm
TL;DR: Anthropic's Claude Mythos autonomously found more than 10,000 high- and critical-severity vulnerabilities across 1,000 open-source projects, with a 72% exploit success rate, showing how AI accelerates entry but not attacker intent, according to Delinea. The practical shift is that identity control, not vulnerability discovery alone, becomes the limiting factor once compromise is possible.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “In the Mythos era, identity is the last line of defense”.
By the numbers:
- Mythos achieved a 72% exploit success rate.
Key questions
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Q: Why do faster vulnerability discoveries still leave identity as the main control point?
A: Because discovery only changes how quickly an attacker can reach a foothold.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Continuously discover every privileged identity Build a current inventory of human admins, service accounts, and AI agents, then map each to owners, privileges, and reachable systems.
- Eliminate standing privileges where possible Replace persistent access with task-scoped access for accounts that can reach sensitive systems, especially where agents or automated workflows operate across multiple services.
- Broaden secrets brokering and vaulting Vault long-lived credentials, inject them only at connection time, and minimise where secrets can persist in agent workflows or administrative tooling.
Bottom line: Faster autonomous vulnerability discovery raises exposure, but the decisive control remains how tightly identity and session rights are constrained after entry.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 8:50 pm
Mythos-class capability does not change the attacker’s goal, but it changes the economics of reaching it. Faster autonomous vulnerability discovery compresses the gap between exposure and exploitation. That makes identity controls the real limiter on damage, because the question is no longer whether a flaw exists but how far access can travel once it is found. The practitioner implication is to measure security by containment depth, not discovery speed.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: When should organisations rotate secrets used by AI agents?
A: Rotate secrets immediately when they are shared across multiple systems, exposed in logs or code, or used by agents with broad access. In agentic environments, rotation is not just a hygiene task. It is a containment control that limits how far compromised credentials can spread through tools, workflows, and dependent services.
👉 Read our full editorial: Mythos-era AI agents raise the stakes for identity security