Anthropic’s most capable model is now in the hands of fifty defenders through Project Glasswing. The same capabilities will be in attackers’ hands within months. The static-detection era is ending. Defenders need investigation at scale, an assume-breach posture, and AI that works inside the operational reality security teams actually live in.

By Ely Abramovitch

Anthropic was right and responsible to release Claude Mythos Preview first to cybersecurity researchers and a select group of organizations through Project Glasswing. It is a genuinely remarkable model. The security community should take it seriously. What is available to defenders today will be in the hands of attackers in a few months. That window is closing fast.

What Mythos Changes

Mythos raises the ceiling on what AI can do in cybersecurity tasks.

Zero-day discovery at scale. Anthropic reports thousands of high-severity vulnerabilities found across every major operating system and web browser, many critical, most still unpatched at the time of disclosure.

Complex reverse engineering. The model handles closed-source software analysis and turns N-day vulnerabilities (known but not yet widely patched) into working exploits.

Multi-path exploit construction. Mythos chains memory corruption bugs together to produce penetration paths that previously required teams of expert researchers and months of reconnaissance.

Lower threshold for sophisticated attacks. The capabilities once accessible only to well-funded nation-state actors can now be replicated by a far broader set of threat actors.

Where AI In Defense Needs To Go First

The industry is converging, rightly, on vulnerability research and remediation as the priority. Scanning your own codebase with the same class of models that attackers are using is a clear first step. In many cases, defenders actually have an asymmetric advantage here, because we have better access to our own code than attackers do.

The harder problem is remediation. We already carry significant backlogs of unresolved, sometimes exploitable, vulnerabilities. An attacker has nothing to lose. Defenders cannot afford mistakes. Our systems are in production. Downtime has real costs. The asymmetry of attacker agility versus defender accountability is where the gap widens.

AI-assisted vulnerability remediation at scale is necessary. It is not a solved problem, and any honest assessment of the landscape has to acknowledge that.

What This Means For Security Operations

The idea of static detections designed to discover dynamic adversaries is fundamentally misguided. The future is better trip wires and an assume-breach mentality.

For SOC teams, the implications are direct. The scale and complexity of attacks is accelerating. We should expect a higher volume of sophisticated attacks that actively evade detection, that do not conform to known signatures or behavioral patterns, and that are designed from the ground up to stay invisible.

This breaks the model that most SOC programs are built on. The idea of maintaining a library of static detections to catch dynamic adversaries has always had limits. Those limits are now being exposed in real time.

What we need instead is the ability to detect a high volume of low-fidelity signals — anomalies in endpoint behavior, data access patterns, email activity, network flows, identity — and the capacity to investigate each one as if it were the leading edge of a sophisticated breach. Not because every alert is a nation-state intrusion, but because the percentage that may be is higher now than it was.

The question is no longer whether to adopt AI in security operations. We cannot scale defenses solely on human labor. The question is how to do it in a way that actually works inside the operational reality that security teams live in.

The Real Challenge Is Operational Reality

Enterprises have legacy and custom tools, established processes, compliance and audit requirements, escalation paths, and oversight obligations that are not optional. AI cannot simply replace this infrastructure. It has to work within it.

You cannot properly scale your defenses without giving AI access to your organizational context: your tools, your processes, your detection logic, and your escalation criteria. AI agents need to investigate with the consistency and rigor of an excellent IR analyst, operate transparently, and support human oversight at the points where it matters.

A new class of investigation infrastructure has emerged to address this layer. Legion, the platform behind this research, is one example. These tools learn the organization’s existing tools, processes, and context and make them accessible to frontier models (now Mythos Preview, and every model that follows). From that foundation they create structured, repeatable workflows where consistency is required, or fully agentic investigations where depth and judgment are required. Every action is auditable. Human-in-the-loop controls are configurable. Integration is across the existing stack rather than as a replacement for it.

The category will grow. Every SOC will need to choose a path through it. The choice that matters is the one that meets the team where it already is, rather than asking the team to start over inside a new platform.

Build For The Adversary Who Has Already Won

Assume breach. Investigate everything. Build for the attacker who has already found the vulnerability you have not patched yet, and is using Mythos-level models to stay ahead of your detections.

The models will keep advancing. Every quarter widens the capability gap. The defenders who treat this as a one-time response will find themselves on the wrong side of the gap inside a year. The defenders who treat it as an operational shift, anchored in investigation at scale and an assume-breach posture, will keep the gap closeable.

That is the work.

This piece reflects the state of the model landscape as of May 2026. Claude Mythos Preview remains a gated research preview through Project Glasswing. AI Cyber Magazine will revisit the topic as the model lineup and the defensive landscape continue to shift.

The New SOC Posture

Assume breach by default. Build for the attacker who has already found the vulnerability you have not patched yet, and is using Mythos-level models to stay ahead of your detections.

Investigate every low-fidelity signal. Endpoint behavior anomalies, data access pattern shifts, unusual email activity, abnormal network flows, identity drift. Treat each as if it could be the leading edge.

Abandon the static-detection library model. Maintaining signatures for dynamic, AI-generated attacks is a losing race. Trip wires plus investigation scale better than libraries plus pattern matching.

Scale investigation, not analysts. The volume of investigations the new posture demands cannot be met by hiring. AI investigation at the depth of an experienced IR analyst is the only path to coverage.

About The Author

Ely Abramovitch is the Co-Founder and CEO of Legion Security, a browser-native AI SOC platform that emerged from stealth in 2025 with $38M in seed and Series A funding led by Coatue, Accel, and Picture Capital. Before founding Legion, Ely was the lead product manager for Microsoft Sentinel, where he helped scale the platform past $1B in annual recurring revenue.