Notifications
Clear all
Topic starter
02/08/2026 11:46 am
TL;DR: Anthropic’s Mythos preview is presented as a model capable of finding and exploiting software flaws at a pace that compresses the window between disclosure and weaponisation, while Checkmarx cites research showing 81% of organisations knowingly ship vulnerable code. The practical implication is that AI-assisted AppSec now needs deterministic validation, not just faster discovery.
NHIMG editorial — based on content published by Checkmarx: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- 81% of organizations knowingly ship vulnerable code driven by overwhelming noise, uncontextualized backlogs, and limited resources.
- LLMs have been observed generating working CVE exploits in just 10–15 minutes at approximately $1 per exploit.
Questions worth separating out
Q: How should security teams handle AI-generated vulnerability findings in the release pipeline?
A: Security teams should treat AI-generated findings as inputs, not decisions.
Q: Why do AI models change the way AppSec teams should prioritise risk?
A: AI changes priority because exploit development is no longer constrained by scarce human expertise.
Q: What do security teams get wrong about AI-powered remediation for NHIs?
A: Teams often assume that faster remediation is automatically safer.
Practitioner guidance
- Reprioritise by exploitability window Rank vulnerabilities by how quickly they can be weaponised, not only by CVSS or backlog age.
- Add deterministic validation before remediation Require code context, runtime evidence, and policy checks before an AI-generated finding can trigger fix work.
- Govern remediation agents like privileged systems Limit agent scope to narrow triage or fix drafting tasks, log every action, and require approval for material code changes.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- The benchmark comparison between Opus 4.6 and Mythos on Firefox exploit generation.
- The article's own framing for deterministic versus probabilistic AppSec in AI-native development.
- The specific recommendations for hybrid AppSec, agentic triage, and remediation workflows.
- The additional discussion points and linked industry material referenced in the source article.
👉 Read Checkmarx's analysis of AI-assisted exploit generation and AppSec risk →
AI model security is shifting from detection to exploit generation?
Explore further
02/08/2026 12:57 pm
AI-assisted exploitation changes the security control that matters most. Once model output can produce working exploits in minutes, the decisive variable is no longer whether a vulnerability exists, but whether the organisation can distinguish exploitable risk from theoretical noise. That shifts AppSec from backlog management to exposure management. For practitioners, this means severity alone is no longer an adequate decision rule.
A question worth separating out:
Q: How can organisations tell whether hybrid AppSec is working?
A: A hybrid AppSec programme is working when model-assisted discovery consistently feeds deterministic validation and measurable remediation outcomes. Look for fewer false positives, shorter verification cycles, and better alignment between exploitability and priority. If AI output is fast but still produces noisy backlog inflation, the model is not improving control quality.
👉 Read our full editorial: AI model security is shifting from detection to exploit generation
