Topic starter
18/08/2026 3:02 pm
TL;DR: AI models are compressing vulnerability discovery and code-production timelines faster than compliance and patch review workflows can absorb, according to Expel's analysis of Anthropic Mythos. The governance gap is no longer just speed, but whether human-in-the-loop controls can still prove meaningful oversight when AI can generate and review code at machine pace.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Mythos found the canary. Here’s what’s in the mine.”.
Key questions
Q: What breaks when AI agents can make code changes faster than humans can review them?
A: Manual review stops being a meaningful control if it cannot keep pace with change volume.
Q: Why does AI-driven code velocity increase exploitation risk during the patch window?
A: Because defenders still need time to test, approve, and deploy fixes, while AI lowers the skill and time needed to turn a patch into an exploit.
Q: How do security teams know if AI-assisted change review is still effective?
A: Look for evidence that reviewers are evaluating risk, not just volume.
Practitioner guidance
- Define review thresholds by change risk Classify code changes by blast radius, privilege impact, and exploitability so AI-generated pull requests receive different scrutiny levels instead of one universal approval path.
- Measure patch lag as an exposure control Track the time from patch availability to production rollout for critical systems, and treat prolonged lag as an active attack window rather than a scheduling issue.
- Separate AI authorship from human accountability Require explicit records for which system generated the change, which human reviewed it, and which approver accepted production risk.
Bottom line: AI-assisted development is compressing the patching and review lifecycle faster than traditional change controls were designed to handle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:41 pm
Agentic code velocity creates governance debt: when AI can generate and review code at scale, the organisation accumulates control obligations faster than human processes can retire them. The problem is not just throughput; it is that assurance models built for human-paced delivery stop matching the change environment. Practitioners should treat the review backlog as a governance exposure, not an administrative nuisance.
A question worth separating out:
Q: Who is accountable when AI helps write and review production code?
A: Accountability still has to sit with the organisation, but the workflow must make that accountability explicit. Teams need named human approvers, defined delegation boundaries for machine assistance, and audit evidence that shows which actor accepted the change into production.
👉 Read our full editorial: AI patching governance is breaking under agentic code velocity