Security researcher argues AI-assisted vulnerability discovery like Anthropic's Mythos model is less disruptive to defenders than headlines suggest

Anthropic is promoting its Mythos cybersecurity model and the volume of vulnerabilities it discovers; Mozilla has confirmed those findings appear legitimate, prompting concern within the industry.

New exploits have historically outpaced defenders' ability to write detection rules, and threat actors have not relied on zero-days to compromise targets—behavioral detection (monitoring patterns of activity rather than individual signatures) remains more effective than writing rules for each specific exploit.

Microsoft Office products have produced more than 1,000 distinct RCE (Remote Code Execution) CVEs as of April 2026, yet detecting their abuse improved significantly after Microsoft's 2022 change to block macros in internet-tagged documents, which reduced Office's share of malware deliveries from 50% in Q4 2021 to 13–15% by 2024–2025.