AI vulnerability discovery at machine speed: are your controls keeping up?

TL;DR: Claude Mythos Preview shows how agentic AI can identify and exploit real vulnerabilities across operating systems, browsers, and AI infrastructure at machine speed, according to Equixly's analysis of the emerging offensive AI era. Traditional annual pentesting and point-in-time validation are no longer enough when time-to-exploit is collapsing and exposure is moving faster than human remediation cycles.

NHIMG editorial — based on content published by Equixly: AI Security After Claude Mythos Preview: Defending at machine speed in the agentic attacker era

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.

Questions worth separating out

Q: How should security teams respond when AI can generate exploit chains from dormant vulnerabilities?

A: Security teams should stop treating exploitability as a human bottleneck and start proving whether a flaw is reachable in their own environment.

Q: Why do APIs create such a large risk surface for autonomous attackers?

A: APIs are predictable, machine-testable, and tightly coupled to business logic, so automated actors can enumerate them and probe for authorization failures quickly.

Q: What breaks when organisations rely on annual pentesting alone?

A: Annual testing leaves long periods where new deployments, identity changes, and exposed endpoints go unvalidated.

Practitioner guidance

• Build continuous exploitability validation Move beyond quarterly testing and validate critical APIs, web apps, and identity paths on an ongoing basis.
• Inventory exposed and shadow API surfaces Map documented, undocumented, and externally reachable APIs, then link them to the credentials and service accounts that can use them.
• Tighten governance for non-human identities Review service accounts, tokens, and delegated access for standing privilege, broad scope, and missing ownership.

What's in the full article

Equixly's full blog covers the operational detail this post intentionally leaves for the source:

• Step-by-step examples of how its AI testing maps exploit paths through APIs, web applications, and MCP implementations.
• The 90-day CTEM and COST rollout plan with day-by-day milestones for baseline, integration, expansion, and board reporting.
• Practical guidance on how the platform prioritises vulnerabilities based on proven exploitability rather than raw severity.
• The article's examples of AI-assisted intrusion, including how the model contributes to attack-chain validation in practice.

👉 Read Equixly's analysis of Claude Mythos Preview and machine-speed defence →

AI vulnerability discovery at machine speed: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →