Notifications
Clear all
Topic starter
02/08/2026 11:46 am
TL;DR: Anthropic’s Claude Mythos and Project Glasswing show that frontier models can find and exploit vulnerabilities faster than humans, but the harder problem remains validating exploitability, delivering fixes, and retesting in live production systems, according to Novee. The governance gap is continuous security validation, not discovery alone.
NHIMG editorial — based on content published by Novee: Claude Mythos and Project Glasswing are research breakthroughs, not security programs
By the numbers:
- Anthropic says it identified thousands of high-severity vulnerabilities across major operating systems and browsers, including a 27-year-old OpenBSD bug.
- Anthropic disclosed that fewer than 1% of the vulnerabilities it found so far have been patched.
Questions worth separating out
Q: How should security teams reduce false positives in AI vulnerability scanning?
A: Require scanners to prove reachability, exposure, and privilege context before findings are allowed to block delivery.
Q: Why do AI-assisted vulnerability discoveries change remediation priorities?
A: Because they shorten the time between disclosure and exploitation.
Q: What breaks when exploit validation is not built into the security workflow?
A: Teams close issues without proving the fix removed the actual attack path.
Practitioner guidance
- Separate discovery from exploitability triage Build a workflow that classifies findings into theoretical, environment-dependent, and demonstrably exploitable categories before remediation begins.
- Measure remediation against retest completion Track whether every confirmed issue is revalidated after the fix, configuration change, or policy update.
- Apply NHI governance to security automation Inventory the service accounts, API keys, and tokens used by scanners, patch orchestration, and validation harnesses.
What's in the full article
Novee's full analysis covers the operational detail this post intentionally leaves for the source:
- The article's breakdown of Claude Mythos and Project Glasswing participation details, including who is involved and why that matters for continuous security validation.
- The specific exploit examples and benchmark context behind the model claims, including the conditions that made the findings possible.
- The source's discussion of how the vendor frames continuous offensive security testing as a workflow, not just a model capability.
- The practical remediation angle the article raises for teams trying to operationalise AI-assisted vulnerability discovery.
👉 Read Novee's analysis of Claude Mythos, Project Glasswing, and continuous vulnerability validation →
AI vulnerability scanning: are your controls keeping up in production?
Explore further
02/08/2026 12:56 pm
Continuous vulnerability discovery is becoming a governance problem, not just a testing improvement. When models can surface thousands of high-severity issues, the bottleneck moves from finding bugs to validating, prioritising, and closing them in real systems. That shifts accountability to the control plane around discovery, remediation, and retesting. Teams should treat exploit validation as an operational discipline, not a quarterly activity.
A question worth separating out:
Q: Who is accountable for the identities used in continuous security testing?
A: Security leadership and IAM owners should share accountability for the identities that power scanning, orchestration, and retesting. If those non-human identities are over-privileged or poorly rotated, the validation pipeline becomes part of the risk surface rather than a control. Ownership should be explicit, reviewed, and time bound.
👉 Read our full editorial: AI vulnerability scanning needs continuous validation, not one-off findings
