On April 7, 2026, Anthropic launched Project Glasswing. The announcement sent shockwaves through the cybersecurity industry, not because of what it promised, but because of what it revealed. Claude Mythos Preview, an AI model with 10 trillion parameters, had autonomously discovered thousands of zero-day vulnerabilities across every major operating system and web browser. Some had existed for 27 years. Others had survived 5 million automated scans.

As one industry analysis put it: "The vulnerability pipeline just got a firehose attached to it."

What Changed

AI-driven vulnerability discovery represents a fundamental shift in how security flaws are found. Mythos doesn't just scan faster, it reasons, chains vulnerabilities together, and discovers exploits that neither humans nor traditional automated tools would conceive. On Firefox alone, it found 90 times more exploits than the previous best model. On industry benchmarks, it scored 83.1% compared to 66.6% for its predecessor.

This isn't incremental improvement. It's a category shift in discovery capability.

Anthropic deemed the model too dangerous for public release. Instead, they deployed it through Glasswing a controlled coalition including AWS, Apple, Microsoft, Google, CrowdStrike, Cisco, and more than 40 organizations. The mission: find and fix vulnerabilities in critical infrastructure before malicious actors develop similar capabilities.

The race is on. And according to Alex Stamos, former CISO of Facebook and Yahoo, we have roughly six months before comparable models proliferate to threat actors.

The Illusion

The natural assumption is that better vulnerability discovery leads to better security. Find more flaws, fix more flaws, reduce risk.

‍But that assumption breaks at scale.Here's what the data shows: According to early analysis, less than 1% of vulnerabilities discovered by Claude Mythos have been patched. Industry research confirms only 7.6% of organizations remediate critical vulnerabilities within 24 hours while attackers can weaponize them in 24 to 48 hours. The mean time to remediate for critical vulnerabilities sits at 65 days. Sixty-five days while AI discovers thousands of flaws in hours.

‍More discovery doesn't equal better security. It equals operational overload.

The Paradox: Discovery Outpacing Operations

We've largely solved visibility. What we've created instead is overload.

‍Security didn't become easier with AI. It became a resource allocation problem.

This creates a structural paradox: The more efficient vulnerability discovery becomes, the more impossible complete remediation becomes. Every organization has finite security teams, finite IT capacity, finite testing environments, finite change windows. When AI can surface thousands of high-severity findings across complex environments in hours, those finite resources become breaking points.

‍The real challenge is prioritization at scale.

‍If an AI surfaces 10,000 vulnerabilities across your infrastructure overnight, the bottleneck isn't "what are our vulnerabilities?" It's "which ones actually threaten us, what do we fix first, who owns the remediation, and how do we prove it's closed?"

‍Discovery is solved. The unsolved problem is remediation operationalization.

The Missing Layer

Glasswing solves vulnerability discovery brilliantly. But discovery is only the first step in a much longer operational chain.

What Glasswing provides: vulnerability discovery at scale, proof of exploitability, zero-day identification, CVE feed enrichment.

What Glasswing doesn't provide: asset context and criticality mapping, risk-based prioritization across your specific environment, assignment to the right owners, workflow orchestration, SLA enforcement, remediation verification, or audit-ready compliance proof.

In other words: Glasswing tells you what's broken. It doesn't tell you what matters most to your business, who should fix it, when, or how to prove it's done.

At small scale, that gap can be managed manually. At the scale AI-driven discovery creates, manual processes collapse entirely. Organizations break, not because they lack visibility, but because they lack the operational infrastructure to translate visibility into verified risk reduction.

‍What's required is not just prioritization, but a full operational loop from ingestion to verified closure.

The Emergence of CTEM

This shift has created a new category requirement: Continuous Threat Exposure Management.

CTEM platforms don't discover vulnerabilities they operationalize vulnerability intelligence at scale. They sit between discovery tools and remediation execution, bridging the gap that AI-driven discovery has widened.

The CTEM layer provides what AI-driven discovery demands: continuous ingestion from hundreds of vulnerability sources, contextual prioritization based on asset criticality and business risk, automated orchestration routing issues to the right owners, remediation tracking through verified closure, and audit-ready proof of risk reduction.

This is the missing layer. And after April 7, 2026, it's no longer optional.

The New Requirement

On April 7, 2026, Anthropic launched Project Glasswing. The announcement sent shockwaves through the cybersecurity industry, not because of what it promised, but because of what it revealed. Claude Mythos Preview, an AI model with 10 trillion parameters, had autonomously discovered thousands of zero-day vulnerabilities across every major operating system and web browser. Some had existed for 27 years. Others had survived 5 million automated scans.

As one industry analysis put it: "The vulnerability pipeline just got a firehose attached to it."

What Changed

AI-driven vulnerability discovery represents a fundamental shift in how security flaws are found. Mythos doesn't just scan faster, it reasons, chains vulnerabilities together, and discovers exploits that neither humans nor traditional automated tools would conceive. On Firefox alone, it found 90 times more exploits than the previous best model. On industry benchmarks, it scored 83.1% compared to 66.6% for its predecessor.

This isn't incremental improvement. It's a category shift in discovery capability.

Anthropic deemed the model too dangerous for public release. Instead, they deployed it through Glasswing a controlled coalition including AWS, Apple, Microsoft, Google, CrowdStrike, Cisco, and more than 40 organizations. The mission: find and fix vulnerabilities in critical infrastructure before malicious actors develop similar capabilities.

The race is on. And according to Alex Stamos, former CISO of Facebook and Yahoo, we have roughly six months before comparable models proliferate to threat actors.

The Illusion

The natural assumption is that better vulnerability discovery leads to better security. Find more flaws, fix more flaws, reduce risk.

‍But that assumption breaks at scale.Here's what the data shows: According to early analysis, less than 1% of vulnerabilities discovered by Claude Mythos have been patched. Industry research confirms only 7.6% of organizations remediate critical vulnerabilities within 24 hours while attackers can weaponize them in 24 to 48 hours. The mean time to remediate for critical vulnerabilities sits at 65 days. Sixty-five days while AI discovers thousands of flaws in hours.

‍More discovery doesn't equal better security. It equals operational overload.

The Paradox: Discovery Outpacing Operations

We've largely solved visibility. What we've created instead is overload.

‍Security didn't become easier with AI. It became a resource allocation problem.

This creates a structural paradox: The more efficient vulnerability discovery becomes, the more impossible complete remediation becomes. Every organization has finite security teams, finite IT capacity, finite testing environments, finite change windows. When AI can surface thousands of high-severity findings across complex environments in hours, those finite resources become breaking points.

‍The real challenge is prioritization at scale.

‍If an AI surfaces 10,000 vulnerabilities across your infrastructure overnight, the bottleneck isn't "what are our vulnerabilities?" It's "which ones actually threaten us, what do we fix first, who owns the remediation, and how do we prove it's closed?"

‍Discovery is solved. The unsolved problem is remediation operationalization.

Using Claude as client of SmartEx² Enterprise MCP Server

Making It Work for You