Oracle's Mythos AI test found 1,400+ flaws, Loaiza says

Oracle's disclosure shows how frontier AI models are changing the economics of database security. When the Mythos model turned up serious vulnerabilities in Oracle's own code, the company treated it as a "code red moment," and the practical result was a quarterly security update that addressed more than 1,400 vulnerabilities across its portfolio. That scale of patching raises the risk of regressions in complex production systems, which is why Oracle points customers to Real Application Testing to capture real workload and verify that patches do not break it.

The second front is internal AI use. Applications have traditionally enforced end-user security, but AI now writes much of that code or goes straight to the data, so Oracle is moving authorization controls down to the data layer with Deep Data Security, which began shipping in April and passes an authenticated user's identity as an encrypted token through to the database. The company has since extended those controls across remote databases, lakehouse data and related tables, and is also providing declarative ways to define business rules along with SQL Assertions that check whether changes made through SQL are valid.