What Mythos Means for European CISOs

Who Defends the Defenders?

On April 7th, Anthropic released Claude Mythos Preview — a model that discovered thousands of zero-day vulnerabilities across every major operating system and web browser, some of which had gone undetected for up to 27 years. The model created working exploits on the first attempt in 83% of cases.

Anthropic decided not to release it publicly. Instead, access was granted to approximately 40 organizations — primarily major tech companies like AWS, Microsoft, Google, CrowdStrike, and Palo Alto Networks — through an initiative called Project Glasswing, backed by $100 million in usage credits.

It’s worth noting that these 40 organizations are among the most well-resourced in the world. They have security teams numbering in the hundreds or thousands, budgets in the billions, and some of them are cybersecurity companies themselves. They are, by definition, the organizations that needed this tool the least to survive. The rest of us — hospitals, energy providers, SaaS companies, transport operators — defend critical infrastructure with a fraction of those resources.

This is not a criticism of that decision. The safety concerns are real. But it raises questions that every CISO in Europe should be thinking about right now.

The Timeline Problem

Anthropic’s own researchers estimate that comparable AI capabilities will emerge from other labs within 6 to 18 months — potentially through open-source models. That means the ability to discover and exploit vulnerabilities at machine speed will eventually be available to threat actors, while the majority of defenders worldwide currently have no access to equivalent defensive tools.

For CISOs managing critical infrastructure, healthcare systems, SaaS platforms, or any organization under NIS2, this creates a planning challenge: how do you prepare for a threat landscape where attackers can find decades-old vulnerabilities in minutes?

The NIS2 Angle

Article 21 of the NIS2 Directive requires essential and important entities to implement security measures reflecting the “state of the art.” If AI-powered vulnerability discovery is becoming the new standard, there is a growing gap between what regulations expect and what most organizations can access.

This isn’t about blame — it’s about readiness. National cybersecurity authorities and ENISA should be engaging with this question now, not after the first wave of AI-augmented incidents.

What CISOs Can Do Today

Even without access to Mythos-class tools, the fundamentals become more urgent:

Accelerate patching cycles, especially for open-source components. The vulnerabilities Mythos found were in widely used software — Linux kernel, OpenBSD, FFmpeg, major browsers. If your infrastructure depends on these (and it almost certainly does), your patching window just got shorter.

Review your asset inventory with a focus on open-source dependencies. Know exactly what you’re running and where your exposure is.

Reduce your attack surface. Every unnecessary service, every unpatched legacy system, every forgotten endpoint is a potential entry point for an attacker armed with AI-powered exploit discovery.

Invest in detection and response. When prevention alone isn’t enough, your ability to detect and contain a breach becomes critical.

The Bigger Picture

Mythos is a signal, not an isolated event. Every major AI lab is pursuing the same improvements in reasoning and code capability that gave Mythos its cybersecurity edge. This is the direction of the industry.

The security community — through organizations like the Cloud Security Alliance, ENISA, and national authorities — should be exploring how to ensure that defenders at all levels get access to AI-powered defensive capabilities, not just the largest players.

The question for 2026 is no longer whether AI changes cybersecurity. It’s who defends the defenders — and whether they’ll have the tools to keep pace.