Topic starter
02/08/2026 11:46 am
TL;DR: 81% of organisations knowingly ship vulnerable code, Checkmarx says from research data. AppSec now needs deterministic validation to separate reachable flaws from noise before faster discovery turns into faster weaponisation.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Checkmarx Application Security Guide to Claude Mythos”.
By the numbers:
- Mythos produced a working exploit in 181 cases for a Firefox JS shell vulnerability example.
- Over 81% of organisations knowingly release software with code they know is vulnerable.
Key questions
Q: Why do AI-generated vulnerabilities increase operational risk even when detection improves?
A: Detection that scales faster than remediation creates a wider exposure gap, not a smaller one.
Q: How do teams know whether AI-assisted AppSec is actually helping?
A: Look for findings that can be traced back to named components, repeated across assessments, and mapped to concrete remediation actions.
Q: What breaks when AI tools find code vulnerabilities but cannot prove exploitability?
A: Security teams end up with more findings than reliable decisions.
Practitioner guidance
- Prioritise exploitability over raw detection volume Rank findings by whether they can be converted into a working exploit in your environment, not by how many issues a model returns.
- Add deterministic validation to AI-assisted AppSec Require a non-probabilistic check before a finding is promoted into the remediation queue, especially for internet-facing code and high-value internal services.
- Automate triage for high-volume vulnerability backlogs Use workflow automation or agentic triage to route noisy findings, group duplicates, and surface the issues with the strongest exploit evidence.
Bottom line: AI model security is shifting because models are beginning to generate exploits, not just identify flaws.
Glossary terms: Exploitability context, Deterministic Validator, Probabilistic Analysis, Agentic triage
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:57 pm
AI model security has crossed from detection into active exploit generation. That is a structural change, not a model performance tweak. Once a model can produce a working exploit with high reliability, the security team is no longer dealing with advisory output alone, but with a system that can compress the time between flaw discovery and weaponisation. The practitioner conclusion is that AI security governance must now account for exploit capacity, not just detection coverage.
A question worth separating out:
Q: Should organisations use probabilistic AI or deterministic validation for vulnerability management?
A: They need both, but for different jobs. Probabilistic AI is useful for scale, discovery, and early triage, while deterministic validation is what turns noisy findings into trustworthy decisions. If a team must choose where to trust automation most, it should trust deterministic checks at the point of remediation priority.
👉 Read our full editorial: AI model security is shifting from detection to exploit generation