Topic starter
19/08/2026 3:55 pm
TL;DR: Autonomous vulnerability discovery is crossing a threshold, with Anthropic’s Project Glasswing and other AI-native programs expected to create disclosure volumes that overwhelm human-paced remediation, according to Cycode. The practical implication is that prioritisation, exposure context, and automated response now matter more than CVSS alone, because patching is becoming a business continuity problem, not just a security workflow.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “What Mythos, Daybreak, and MDASH Mean for Your CVE Remediation Pipeline”.
By the numbers:
- The model fully autonomously discovered and exploited a 17-year-old remote code execution bug in FreeBSD.
- It found a 27-year-old vulnerability in OpenBSD.
- It hit 72.4% on autonomous exploit development in the Firefox JavaScript shell.
Key questions
Q: What breaks when vulnerability discovery outpaces remediation capacity?
A: When discovery moves faster than validation and patching, the backlog becomes the control failure.
Q: Why do CVSS scores become less useful during disclosure floods?
A: CVSS describes abstract severity, not whether a vulnerable code path is actually reachable in your environment.
Q: What are the signs that remediation governance is failing under AI-driven CVE volume?
A: Common signs include long queues of unowned findings, repeated delays in code review, patch decisions driven by panic rather than exposure, and emergency changes that bypass normal release discipline.
Practitioner guidance
- Stress-test remediation throughput against simultaneous critical CVEs Run quarterly flood drills with ten high-severity vulnerabilities, and measure triage speed, ownership handoff, code review, deployment, and communications under pressure.
- Prioritise by reachability and exposure Use runtime signal, internet exposure, network pathing, and environmental preconditions to decide what gets fixed first instead of relying on abstract severity alone.
- Automate the remediation handoff chain Connect finding intake to owner assignment, draft fixes, pull requests, and deploy planning so security staff are approving risk, not manually coordinating every step.
Bottom line: AI-assisted vulnerability discovery is shifting the limiting factor from bug finding to patch absorption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:31 pm
AI-driven disclosure has moved vulnerability management from episodic response to continuous operational pressure. Cycode’s argument is not just that more bugs will be found, but that they will be found in parallel, at machine speed, and across a wider portion of the stack. That changes the governance problem from patching discrete events to absorbing a sustained discovery flood. Practitioners should now design remediation as a resilience function, not a queue-management exercise.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations automate fixes for AI-generated vulnerabilities?
A: Yes, for repeatable flaw classes where the fix is well understood and the risk of delay is high. Automated remediation should handle predictable issues such as input validation, secret handling, and object reference mistakes, while humans focus on architectural decisions and exceptions. That division is the only scalable way to keep pace with AI-assisted delivery.
👉 Read our full editorial: AI-driven CVE discovery will outpace remediation pipelines