Topic starter
02/08/2026 11:33 am
TL;DR: AI-assisted vulnerability discovery is collapsing the old CVE triage model: Mythos and similar LLMs can identify the same flaws from identical code context, while Anthropic’s Project Glasswing found more than 10,000 high- or critical-severity issues in its first month, according to OXSecurity. Security teams now need chain-level context, not raw finding volume, because risk lives in exploitability and reachability, not the CVE count.
Editorial analysis by NHI Mgmt Group, based on content published by OXSecurity: “The CVE Is Dead. Long live the Mythos Era.”.
By the numbers:
- Cloudflare alone received 2,000 bug reports.
Key questions
Q: What breaks when vulnerability counts are used as the main risk signal?
A: Teams lose the ability to distinguish exploitable paths from noisy discoveries.
Q: Why do exploit chains matter more than CVSS scores in practice?
A: CVSS measures individual severity, but attackers operate across connected weaknesses.
Q: What signs show that a vulnerability programme is overcounting risk?
A: Look for remediation queues dominated by uncorrelated findings, weak linkage between scanner output and runtime reachability, and repeated attention on issues that never connect to sensitive data, privileged accounts, or externally reachable code paths.
Practitioner guidance
- Prioritise exploit-chain review for high-volume findings Group related CVEs by reachable attack path, shared dependencies, and privilege boundaries before assigning remediation priority.
- Add identity context to vulnerability triage Flag any finding that can expose secrets, touch service accounts, or cross an authentication boundary, because those conditions usually change severity.
- Separate discovery volume from remediation urgency Track raw findings, but base executive reporting on exploitable chains, reachable assets, and business-critical paths rather than total CVE counts.
Bottom line: AI-assisted discovery has turned CVE listings into high-volume metadata that still needs context before anyone can judge real exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:47 pm
CVE volume is now security metadata, not security meaning: the industry has confused enumerating weaknesses with understanding attacker paths. OXSecurity's point is that AI has accelerated discovery faster than human triage can absorb it, so the critical unit is no longer the finding but the exploit chain. For identity teams, that means the same vulnerability may be routine or catastrophic depending on what credentials, tokens, or service accounts sit behind it. Practitioners should treat CVE volume as background noise unless it can be tied to real reachability.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams judge a CVE when identity boundaries are involved?
A: Treat any issue that can expose secrets, bypass authentication, or reach a service account as materially more serious than the same flaw in a dead-end component. Identity scope, privilege inheritance, and token reach often determine whether the vulnerability is operationally important.
👉 Read our full editorial: CVE volume is becoming security metadata, not usable risk