Topic starter
10/07/2026 9:14 pm
TL;DR: Elisity argues that Claude Mythos showed AI can discover, validate, and weaponize decades-old flaws faster than many organisations can patch them, with a 72.4% exploit success rate and exploit development costs under $2,000. The practical response shifts from patch velocity to containment and microsegmentation, especially for devices that will never be patched.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Claude Mythos and the New Math of AI Vulnerability Discovery”.
Key questions
Q: What breaks when AI finds vulnerabilities faster than teams can patch them?
A: The standard vulnerability-management model breaks because it assumes discovery is slower than remediation.
Q: Why do unpatchable devices create such a large security problem?
A: Unpatchable devices turn every software flaw into a long-term exposure because defenders cannot rely on remediation to remove the weakness.
Q: What do security teams get wrong about microsegmentation?
A: They often treat it as a one-time network redesign instead of an iterative control that depends on current workload behaviour.
Practitioner guidance
- Map unpatchable assets first Inventory IoT, OT, medical, and other devices that cannot reliably receive timely patches, then classify them as containment-first assets.
- Enforce identity-based microsegmentation Apply least-privilege network policy at the device and workload boundary so a compromised endpoint cannot reach critical services by default.
- Prioritise blast-radius reduction over patch dependency Use segmentation, protocol allowlists, and tight east-west controls to limit lateral movement where patch windows are long or impossible.
Bottom line: AI-driven vulnerability discovery now compresses the time between finding a flaw and turning it into a working exploit.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:36 pm
AI vulnerability discovery has crossed from discovery support into exploit production. The important change is not that models find more bugs, but that they can now validate, chain, and weaponize them quickly enough to defeat human patch rhythms. That shifts the security problem from remediation speed to blast-radius control. Practitioners should treat automated discovery as a standing assumption in threat modelling, not a future capability.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise patching or containment for high-risk device fleets?
A: For patchable systems, patching remains necessary, but for fleets with long patch cycles or no patch path, containment should come first. The right priority depends on whether the device can be remediated in time. If not, reduce reachable services and enforce network-level least privilege.
👉 Read our full editorial: AI vulnerability discovery has outpaced patching and containment