When AI Finds the Bugs: Building an AI-Ready VulnOps Capability

In April 2026, Anthropic's Mythos model showed that AI can now autonomously discover and weaponize software vulnerabilities at a scale and speed no human team can match, generating working exploits with a 72% success rate, including a 27-year-old OpenBSD flaw. In one test, Mythos produced 181 working Firefox exploits from a single prompt, where Claude Opus 4.6 managed only two under the same conditions.

This isn't a new threat so much as a sharp acceleration of one that was already underway. VulnCheck's 2026 Exploit Intelligence Report, covering 2025, before Mythos-class models reached wide deployment, showed adversaries were already using AI to move faster: 14,400+ exploits tracked across 10,480 CVEs, 884 new Known Exploited Vulnerabilities, and nearly 29% of those exploited on or before the day the CVE was published, up from 23.6% the year before. Mythos doesn't start that trend; it compresses it by an order of magnitude.

The takeaway: attackers can now find and weaponize bugs at machine speed, and that capability is only getting faster and more accessible. Traditional vulnerability management, built around quarterly scans and 30–60 day patch cycles, wasn't designed for a world where a third of exploited vulnerabilities are already in play on day zero. Organizations need to treat high-risk vulnerabilities as operational events, not backlog items.

On August 13, Blackwire Labs and VulnCheck hosted a 60-minute briefing on what this means for Government security teams and how to respond.

Attendees gained actionable insights on: