AI discovery and patch windows: are your controls keeping up?

TL;DR: Claude Mythos found thousands of zero-day vulnerabilities in weeks, including a bug in OpenBSD’s TCP stack that went unnoticed for 27 years, while exploit development can now happen in hours rather than weeks, according to Absolute Security research. The security model has shifted from patch review pace to automated resilience, where delay itself becomes the exposure.

Editorial analysis by NHI Mgmt Group, based on content published by Absolute Security: “Resilience in the Age of AI: Lessons from Claude Mythos”.

By the numbers:

• The industry average time to patch still hovers around 30 days.
• A bug in OpenBSD’s TCP stack went unnoticed for 27 years.
• Mythos demonstrated a 72.4% exploit success rate.

Key questions

Q: What should security teams do when exploitation can happen before normal patch cycles finish?

A: They should move to risk-based remediation that prioritises exploitability, exposure, and business criticality rather than patch queues alone.

Q: Why does faster AI-driven vulnerability discovery increase risk for enterprise patch and dependency management?

A: When exploits can be engineered soon after disclosure, the gap between finding a flaw and weaponising it collapses.

Q: What are the signs that patch governance is too slow for modern attack speed?

A: Warning signs include long approval chains, repeated deferrals for critical updates, no canary deployment path, and teams that still depend on human review before every rollout.

Practitioner guidance

• Shorten remediation decisions for high-risk exposures Classify vulnerabilities by exploitability and business exposure, then set separate handling for flaws that can be weaponised within hours rather than days.
• Automate patch validation before broad deployment Use canary groups, synthetic testing, and rollback triggers so faster patching does not create a stability outage during rollout.
• Tie resilience planning to privileged service dependencies Identify which mission-critical applications, service accounts, and control planes would fail first if patching or a security tool breaks.

Bottom line: AI-assisted discovery is collapsing the time defenders have to respond, so patch latency now functions as an exposure control problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →