When AI Finds the Bugs: Building an AI-Ready VulnOps Capability

In April 2026, Anthropic's Mythos model showed that AI can now autonomously discover and weaponize software vulnerabilities at a scale and speed no human team can match, generating working exploits with a 72% success rate, including a 27-year-old OpenBSD flaw. In one test, Mythos produced 181 working Firefox exploits from a single prompt, where Claude Opus 4.6 managed only two under the same conditions.

 

This isn't a new threat so much as a sharp acceleration of one that was already underway. VulnCheck's 2026 Exploit Intelligence Report, covering 2025, before Mythos-class models reached wide deployment, shows adversaries were already using AI to move faster: 14,400+ exploits tracked across 10,480 CVEs, 884 new Known Exploited Vulnerabilities and nearly 29% of those exploited on or before the day the CVE was published, up from 23.6% the year before. Mythos doesn't start that trend, it compresses it by an order of magnitude.

 

The takeaway: attackers can now find and weaponize bugs at machine speed, and that capability is only getting faster and more accessible. Traditional vulnerability management, built around quarterly scans and 30-60 day patch cycles, wasn't designed for a world where a third of exploited vulnerabilities are already in play on day zero. Organizations need to treat high-risk vulnerabilities as operational events, not backlog items.