AI-Enabled Cyberattacks Surge 89%: Inside Mythos Preview and the New Vulnerability Arms Race

What Anthropic’s Mythos Preview Actually Does

Anthropic quietly introduced a model called Mythos Preview, and its reported capabilities are significant. According to the source reporting, Mythos Preview can identify thousands of vulnerabilities across major operating systems and web browsers.

That is not a research demo. That is a capability with direct operational implications.

Roughly 40 organizations received early access. Most governments, smaller institutions, and the broader security community did not. That asymmetry matters enormously, and we will come back to it.

The core mechanism is what makes this so disruptive. Modern AI tools — Mythos Preview included — can analyze a software patch, infer what flaw it was fixing, and produce functional exploit code before most organizations have even applied the update. The patch itself becomes a roadmap for the attack.

The Exploit Timeline Has Fundamentally Changed

Traditional threat modeling assumed a buffer. Security teams expected days, sometimes weeks, between a vulnerability being disclosed and attackers weaponizing it. Incident response playbooks were built around that assumption.

That assumption is now outdated.

When exploit code can be generated in minutes, the entire calculus of patch prioritization shifts. A vulnerability rated “high severity” that your team planned to patch in the next sprint cycle may already be actively exploited before the sprint begins. The old risk tolerance no longer applies.

This is not theoretical. Security researchers have observed AI tools completing the full cycle — patch analysis, flaw identification, exploit generation — at a speed that eliminates the defender’s traditional time advantage.

Criminal Groups Are Lowering the Skill Floor

The threat is not just coming from sophisticated nation-state actors. AI is democratizing offensive capability in ways that should concern every security operations team.

Criminal groups are now using AI to:

• Automate phishing campaigns at scale
• Generate deepfake audio and video for social engineering
• Craft custom malware without requiring deep technical expertise
• Orchestrate automated attack programs that adapt in real time

The skill barrier for complex cyberattacks has dropped significantly. Operations that previously required specialized knowledge and significant resources can now be assembled by less sophisticated actors using AI tooling. That expands the threat surface in ways that are difficult to quantify but easy to observe in incident data.

The Access Gap Is a Systemic Risk

Here is the part of this story that does not get enough attention.

Forty organizations got early access to Mythos Preview. Most did not. That gap — between who has access to advanced defensive AI and who does not — creates systemic fragility across the broader ecosystem.

Critical infrastructure does not operate in isolation. Hospitals, utilities, supply chains, and financial systems are deeply interconnected. A single exploitable weak point in an under-resourced institution can propagate failures across the entire network. When advanced defensive tooling is concentrated among a small group of well-resourced organizations, the weakest links remain exposed.

This is not a criticism of Anthropic’s rollout strategy. Controlled early access for powerful models is a reasonable approach. But the policy and procurement implications are real. Governments and smaller institutions that lack access to equivalent defensive capabilities face a materially different threat environment than the organizations that do.

What the Cybersecurity Workforce Shortage Amplifies

Layer the workforce problem on top of the tooling gap and the picture gets worse.

The cybersecurity talent shortage is not new, but AI-enabled attacks are making it more consequential. When exploit timelines compress to minutes, human response capacity becomes the binding constraint. You cannot hire your way out of a problem where the attack moves faster than any analyst can manually track.

Organizations that are already understaffed face a compounding disadvantage. They have fewer people to monitor telemetry, fewer resources to invest in advanced tooling, and less capacity to run the rapid patching cycles that the current threat environment demands.

Watch workforce metrics alongside attack data. The staffing gap is not a separate issue — it is a force multiplier for every other vulnerability in this analysis.

What Security Teams Need to Do Right Now

The threat landscape has changed. The response needs to change with it.

Rebuild your threat models around compressed timelines. If your incident response playbook assumes days between disclosure and exploitation, revise it. Model for hours. In some cases, model for minutes.

Reprioritize patch cadence aggressively. Vulnerabilities in major operating systems and browsers are now higher-risk than your previous scoring may reflect. Treat patch deployment speed as a security control in its own right.

Monitor vendor advisories and exploit telemetry in near real time. Passive monitoring on a weekly cycle is insufficient. Establish processes for continuous tracking of threat intelligence from firms like CrowdStrike and others publishing exploit prevalence data.

Track early-access programs for advanced security models. Mythos Preview went to 40 organizations. Future models with defensive applications will follow similar rollout patterns. Knowing what is available — and pursuing access — is now a competitive security decision.

Invest in automation on the defensive side. If attackers are using AI to automate exploit generation, defenders need AI to automate detection, triage, and response. The human-only SOC is increasingly outmatched.

The Bigger Picture: An Arms Race With Uneven Sides

The 89% increase in AI-enabled incidents is not a data point to file away. It is a signal that the arms race between offensive and defensive AI is already underway — and right now, the offensive side has structural advantages.

Attackers benefit from asymmetry. They only need to find one exploitable flaw. Defenders need to protect everything, all the time, with teams that are already stretched thin.

AI does not change that fundamental asymmetry, but it does accelerate it. The organizations that close the gap fastest — through better tooling, faster patching, mature incident response, and access to advanced defensive models — will maintain containment. Those that do not will face a threat environment that their current posture was not designed to handle.

The “AI bugocalypse” framing may sound dramatic. Given what the data is showing, it may also be accurate.

The question is not whether your organization will face AI-enabled attacks. The question is whether your defenses are moving as fast as the attacks are.