AI patching governance - are review controls keeping up?

TL;DR: AI models are compressing vulnerability discovery and code-production timelines faster than compliance and patch review workflows can absorb, according to Expel's analysis of Anthropic Mythos. The governance gap is no longer just speed, but whether human-in-the-loop controls can still prove meaningful oversight when AI can generate and review code at machine pace.

NHIMG editorial — based on content published by Expel: Anthropic Mythos, cybersecurity, and the patching governance problem

Questions worth separating out

Q: How should security teams govern AI-generated code in production pipelines?

A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.

Q: Why do AI-generated code changes create new patch governance risks?

A: AI-generated changes compress the time available for human review and can overwhelm workflows built for smaller, slower releases.

Q: What breaks when patching workflows assume humans can always keep pace?

A: The workflow breaks at the point where disclosure, triage, and approval take longer than the time attackers need to weaponise the weakness.

Practitioner guidance

• Define approval boundaries for AI-assisted code changes Specify which changes require human approval, which may be machine-assisted, and which identities are allowed to sign off on releases.
• Measure patch-window exposure as a security metric Track the time between disclosure, internal triage, fix deployment, and verification for critical assets.
• Treat AI reviewers as delegated identities Assign each review agent a bounded role, clear approval scope, and revocation path.

What's in the full article

Expel's full blog post covers the operational detail this post intentionally leaves for the source:

• The full interview framing with Greg Notch, James Shank, and Marcus Hutchins, including how they interpret Mythos in context.
• The CSA report discussion on patching governance, code review pressure, and AI-assisted delivery assumptions.
• The detailed argument about why human-in-the-loop compliance models struggle when AI changes arrive at 10x velocity.
• The broader discussion of AI as both a cybersecurity problem and a governance mechanism for other knowledge-work domains.

👉 Read Expel's analysis of Anthropic Mythos, patching governance, and AI-driven code review →

AI patching governance - are review controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →