Topic starter
02/08/2026 11:28 am
TL;DR: Claude Mythos can autonomously find novel vulnerabilities in code, but Veracode argues it is too slow, too costly, and too inconsistent to replace deterministic scanning in enterprise pipelines. The practical shift is toward layered assurance, where AI-assisted deep review supplements, rather than substitutes for, repeatable AppSec controls.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “Why Claude Mythos Changes AppSec Research, Not Your Scanning Stack”.
By the numbers:
- The Anthropic and Mozilla security review of Firefox cost approximately $4,000 in AI compute alone.
- Anthropic committed $100 million in compute credits to Project Glasswing participants.
Key questions
Q: How should teams use AI vulnerability research without replacing baseline scanning?
A: Use AI research as a selective deep-review layer for hard problems such as complex logic, authentication paths, and contextual flaws.
Q: Why do AI scanners create governance issues for security programmes?
A: AI scanners create governance issues because they change the scale and speed of decision-making.
Q: What breaks when AI findings are inconsistent between scans?
A: Tracking breaks first, because severity shifts make it hard to measure time to find, time to fix, and improvement trends.
Practitioner guidance
- Preserve deterministic scanning on every code change Keep baseline SAST and dependency checks in the merge path so every pull request gets the same repeatable control, severity model, and audit trail.
- Route only high-risk code into deep AI review Use semantic AI analysis for complex business logic, authentication flows, or hard-to-model pathways where pattern-based tools are least reliable.
- Separate operational triage from exploratory findings Require confirmed findings to create tickets and compliance evidence, while treating AI research outputs as candidate issues until validated by a deterministic control.
Bottom line: Claude Mythos shows that semantic AI can uncover vulnerabilities missed by pattern-based scanners, but that capability does not make it a viable replacement for continuous baseline coverage.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:44 pm
Baseline determinism still wins the governance test: security controls that cannot run on every pull request do not function as pipeline controls, regardless of how sophisticated their reasoning is. AI-assisted vulnerability discovery has value, but repeatable coverage, stable severity, and auditable closure remain the properties that make AppSec governable. Practitioners should treat deterministic scanning as the control plane and deep AI review as an exception path.
A question worth separating out:
Q: How should teams govern AI-assisted code review without losing SAST coverage?
A: Use AI-assisted review to expand discovery, but keep SAST as the deterministic baseline that every change must pass. The practical model is layered assurance: generation-time checks, CI scanning, and release gates. That combination reduces blind spots without turning probabilistic findings into the only source of truth.
👉 Read our full editorial: Claude Mythos changes AppSec research, not scanning stack