Mythos, the Patch Ceiling and Survivability Engineering
Apr 2026
Quick analysis. Apologies for the length.
TL;DR
I read The "AI Vulnerability Storm": Building a "Mythos-ready" Security Program (PDF) by CSA, SANS, and OWASP, and it's worth reading in full. The key message is that centering a security program on vulnerability patching no longer works, and the focus needs to shift to recoverability, assuming vulnerabilities will be exploited before anyone can close them.
Mythos and the Patch Ceiling
Anthropic released Claude Mythos Preview on April 7, and it found thousands of zero-days across every major OS and browser, hit a 72% exploit success rate, and generated 181 working Firefox exploits where the prior model produced 2. The window between disclosure and exploitation is now under one day, and patches can't be tested and deployed at that speed without creating new failure modes of their own. Patching has hit its floor.
Mythos didn't change the structure of the problem. Susceptibility, blast radius, and recovery time still determine how bad it gets when something goes wrong, and an attacker moving at machine speed still has to move through the environment it's attacking. The CSA paper recommends segmentation, egress filtering, phishing-resistant MFA, zero trust architectures, and secrets rotation, all of which form the baseline for Security Brutalism and Survivability Engineering. The question worth asking has moved from whether a system is patched to whether it can be reached and how far an intrusion can travel if it isn't. An environment with bounded blast radius, no standing access, and tested recovery holds up against speed far better than one built around closing vulnerability windows.
"If your primary risk reduction strategy is closing vulnerability windows through patching, and the window is now hours, you are no longer primarily reducing risk. You are generating documentation of your inability to reduce risk fast enough."
Building a consequence map is more useful now than ever, since most organizations don't know which systems would end them versus which would just hurt. Models like Mythos, and others that will catch up, will find the forgotten service accounts, the CI/CD pipelines with undocumented production access, the long-lived credentials still in rotation, and every other loose end left by ordinary security hygiene. The real attack surface is almost always larger than the current inventory shows.
The same logic applies to agents. An AI agent with production access is an identity with permissions, and it deserves the same caution as a human operator who moves fast and exercises no judgment: least privilege, scoped tasks, human approval before irreversible actions, and every tool call logged.
The burnout section of the paper reflects something real. Security teams absorbing accelerating workload without proportional headcount is a survivability finding, not an HR issue, since a response capability that concentrates in a few people who are burning out carries the same blast radius as any other single point of failure.
A program built around survivability engineering was already asking the right questions before Mythos existed: assume compromise is possible, bound the blast radius, test recovery with evidence, and detect actual adversary behavior on the systems that count. Mythos doesn't change that approach, it raises the cost of not having taken it. Mythos isn't the event, it's the calibration point, one that old-school security professionals already knew was coming, and comparable capabilities will reach open-weight models soon.
The patch window is gone. Survivability is what's left.
What's next?
The harder question is what comes after this. Survivability engineering has assumed until now that the systems being defended are deterministic, and that restoring to a known-good state means something concrete. That assumption is eroding on two fronts.
The identity problem is scaling faster than anyone's ability to manage it. Most organizations already have more service accounts and API keys than they can track, and within twelve months they'll have more agents and more agent-to-agent trust relationships than any team can follow manually. The consequence map needs to become a living document rather than something reviewed once a year.
Restoring an AI system to a known-good state doesn't have a clean answer yet, either. A traditional system has a backup and a restoration procedure, while an agent has weights, system prompts, tool configurations, memory stores, and interaction history, none of which map cleanly onto that old model. The organizations that work through this now will be in a different position once it becomes urgent.
That's what we're working on next.