10,000 zero-days in a month: Anthropic's Mythos goes to defenders only

The Frontier-Defensive-AI Capability Has Arrived. The Operational Tier Behind It Has Not Yet Been Built.

On 2026-04-07 Anthropic announced the Claude Mythos Preview — the first model whose strongest measured improvements over Claude Opus 4.6 are in mathematics, long-context reasoning, software engineering, and cybersecurity. The cybersecurity improvements specifically are what put Mythos Preview on the public record as a step-change. On expert-level Capture-the-Flag tasks, Mythos Preview succeeds 73% of the time. It is the first model on record to solve the 32-step “The Last Ones” multi-stage takeover simulation autonomously. At exploit development specifically, Mythos Preview demonstrates a roughly 90x improvement over Claude Opus 4.6.

Anthropic shipped Mythos Preview with no public API, no pricing sheet, and no published general-availability timeline. Access is restricted to Project Glasswing, a controlled program serving roughly 50 vetted defensive cybersecurity organizations — Microsoft, Apple, Google, Cloudflare, and a similar roster of others — backed by a $100M Anthropic-funded credit pool. In its first month of operation, Glasswing partners using Mythos Preview autonomously surfaced over 10,000 high- and critical-severity zero-day vulnerabilities across the world’s most critical software systems.

Read narrowly, the Glasswing first-month number is the headline. Frontier defensive-AI capability is on the public record, with a measured discovery rate, against named-customer software targets. Read narrowly, the takeaway is “Anthropic and the 50 Glasswing partners are running the next-generation cybersecurity discovery program, and the rest of the industry watches and waits for the GA window to open.”

That is a true read. It is also an incomplete read, because the Glasswing first-month number is a discovery-primitive number, and the customer-side problem is a continuous-posture problem.

The under-discussed read is this. Frontier defensive-AI capability is a one-shot discovery primitive. The operational tier that turns the discovery into continuous posture across the customer’s actual deployed-asset inventory is a separate, distinct, and structurally critical layer. The 10,000+ zero-days Glasswing surfaced in its first month are a finding stream. The structural question for every platform team in 2026 is: when those findings (and the next wave, and the wave after) cross the customer’s specific footprint, what is the operational fabric that ingests them, correlates them against the customer’s deployed inventory, prioritizes the remediation queue against the customer’s blast-radius and compliance-binding catalog, drives the patch-deployment pipeline, captures the audit-trail entry, and surfaces the exceptions for explicit approval?

The answer is not the discovery primitive. The answer is the active operational layer underneath the discovery primitive.

What the Mythos + Glasswing Capability Actually Demands of a Platform Team

Five concrete obligations sit on the customer side of the frontier-defensive-AI-capability shared-responsibility line once the Mythos + Glasswing capability is taken as the operating frame for 2026 cybersecurity posture. None of them is satisfied by “wait for the GA window.”

1. Continuous ingestion of the frontier-defensive-AI finding stream. Glasswing partners are the first cohort of frontier-defensive-AI consumers, not the last. As the GA window opens — and as the second and third frontier-defensive-AI models from other providers reach a comparable capability frontier — the customer-side finding stream will grow by orders of magnitude. The 1,200+ KEV entries that anchored the batch 29 Microsoft Defender piece is the 2026 baseline. The post-frontier-defensive-AI baseline will be measured in tens or hundreds of thousands of additional surfaced findings. The customer’s operational tier has to ingest the finding stream continuously, not periodically.

2. Per-finding correlation against the customer’s specific deployed-asset inventory. A frontier-defensive-AI finding is a vendor-side or open-source-side finding — a zero-day in a library, a misconfiguration class in a managed service, a logic flaw in a protocol implementation. The customer-side question is “does the customer deploy the affected component, where, in what version, with what blast radius?” That correlation is not an LLM-discovery task. It is an inventory-and-correlation task that requires a live, accurate, per-asset deployment inventory across every connected cloud, every endpoint class, every workflow-automation control plane (per the companion piece in this batch), every MCP-config-file surface, and every runtime component. The discovery primitive does not have that inventory. The active operational layer does.

3. Per-finding remediation orchestration through the customer’s deployment pipeline. A correlated finding becomes a remediation candidate. The remediation has to be orchestrated through the customer’s deployment pipeline — the patch-deployment pipeline for vendor binaries, the configuration-drift-correction pipeline for misconfigurations, the auto-PR pipeline for code-side findings, the secrets-rotation pipeline for credential-related findings, the IAM-binding-correction pipeline for identity-related findings. None of those orchestrations are LLM-discovery tasks. All of them are agent-orchestration tasks that the active operational layer absorbs.

4. Per-finding capability-tier governance against the customer’s approval policy. A finding with a reversible / scoped remediation is Operate-tier. A finding that requires a deployment change or an IAM-binding edit is Operate-tier with pre-authorization. A finding that requires an organization-wide configuration change or a separation-of-duties exception is Administer-tier with explicit human approval. The capability-tier governance has to map every finding-class to a tier and codify the pre-authorization scope. Without that mapping, the finding stream is a queue without a governance scaffold.

5. Immutable audit-trail entry for every ingested finding, every correlation, every remediation, every exception, and every approval. The audit trail is the auditor-readable, cyber-insurance-readable, regulator-readable artifact for the customer’s frontier-defensive-AI-driven security posture. Internal audit, external auditors, cyber-insurance underwriting, federal-contracting compliance chains, and the customer’s own quarterly security-posture review all anchor against the audit trail.

Each of the five obligations is a continuous workload. The aggregate workload is a multiple of what any reasonably-sized security team can absorb by hand at the 2026 frontier-defensive-AI rate of finding-stream growth. The 2026 frontier-defensive-AI posture for the customer-side is the active operational layer underneath the discovery primitive.

Why the Discovery Primitive and the Operational Tier Are Structurally Distinct

The discovery primitive and the operational tier are structurally distinct in a way that platform teams should understand explicitly before they reason about the 2026 posture.

The discovery primitive is provider-side and one-shot. Mythos Preview running inside Project Glasswing reads source code, fuzzes binaries, models protocols, hypothesizes vulnerabilities, executes proof-of-concept exploits, and produces a bug report. The output is a finding. The next finding is the next run. The provider-side capability is the discovery primitive. It does not know the customer’s deployed-asset inventory. It does not know the customer’s secrets-management policy. It does not know the customer’s compliance bindings. It does not know the customer’s approval scaffold.

The operational tier is customer-side and continuous. The customer-side operational tier reads the finding stream, correlates each finding against the customer’s specific deployed-asset inventory, prioritizes the remediation queue against the customer’s blast-radius and compliance-binding catalog, orchestrates the remediation through the customer’s deployment pipeline, captures the audit-trail entry, and surfaces the exceptions for explicit approval. It runs continuously. It runs against the customer’s specific footprint. It is the active operational layer.

The two layers are complementary, not substitutable. A customer with access to the discovery primitive and no operational tier has a stream of findings without the orchestration to act on them. A customer with the operational tier and no access to the discovery primitive has the orchestration but is reading only the standard CVE / KEV stream — which is the 2025-2026 baseline, not the post-frontier-defensive-AI baseline.

The 2026 posture for the customer requires both. The provider-side capability frontier is moving — Anthropic with Mythos and Glasswing, the other frontier model providers with their own programs on comparable timelines. The customer-side operational tier has to be built to ingest the finding stream regardless of which provider produces it, with BYOK on the model keys so the customer’s frontier-AI spend is a separate procurement track from the orchestration layer.

Why BYOK Is the Structural Unlock Specifically Here

The BYOK pricing model — the customer brings their own Anthropic / OpenAI / vendor keys and pays inference costs directly to the model provider, while the active operational layer charges for the per-action orchestration work — is the structural unlock specifically for the frontier-defensive-AI capability case.

A customer that pays for the frontier-defensive-AI capability through an active-operational-layer subscription that wraps the LLM call and charges a markup is paying for the LLM call once at the customer-to-vendor markup and once at the orchestration-layer markup — and the orchestration-layer markup compounds at the frontier-AI inference rate. The compounding-markup math is bad enough at the Opus 4.6 inference cost. It is much worse at the Mythos / future-frontier inference cost.

A customer on BYOK pricing pays the model provider once at the customer-to-vendor rate (negotiated through procurement, amortized across every consumption surface), and pays the orchestration layer once at the per-orchestration-action rate (decoupled from inference cost, scaling with the number of operational actions). The compounding-markup math is replaced with additive-cost math. The customer can swap the frontier-AI model when a cheaper / better model ships without renegotiating the orchestration layer.

BYOK is also the procurement-cycle unlock. The customer’s frontier-AI spend approval lives inside the model-provider procurement track. The orchestration-layer procurement is a separate, smaller, single-vendor track. The two-track structure compresses the procurement cycle versus the wrapping-LLM-call-and-charging-markup alternative.

See the IAN team run on your cloud. We connect to your AWS account via a scoped read-only role, run the Observe-tier agents, and leave you with a concrete audit report — cost waste, security exposure, compliance gaps, and a labor-offset estimate. You keep the findings regardless of next steps. Get a free infrastructure audit →

What the Mythos + Glasswing Announcement Means for the Platform-Engineering Roadmap

Four operational questions the Mythos + Glasswing announcement shifts for the 2026 platform-engineering roadmap.

• The frontier-defensive-AI capability is on the public record as a structural shift, not a research preview. The 90x exploit-development number, the 73% expert-CTF number, the 10,000+ first-month zero-day number are not lab benchmarks. They are vendor-published results against named-partner targets. The platform-engineering roadmap that does not plan for the customer-side operational tier to ingest the post-frontier-defensive-AI finding stream is a roadmap that bets on the standard CVE / KEV stream remaining the steady-state baseline. The Mythos + Glasswing data is the case that the bet is becoming less safe.
• The customer-side operational tier is the differentiator, not the discovery primitive. The customer cannot build a frontier-defensive-AI model. The customer can build (or procure) the active operational layer that ingests the finding stream and turns it into continuous posture. The structural leverage on the customer side is the operational tier.
• BYOK on model keys is the structural pricing unlock specifically at the frontier-AI capability frontier. The compounding-markup math against the frontier inference rate is bad. The additive-cost math against BYOK is workable. Platform-engineering roadmaps that have not structured their model-spend negotiation around BYOK should expect the procurement cycle to dominate the post-frontier-defensive-AI deployment timeline.
• MCP-first interfaces are the structural distribution unlock. The same MCP fabric that the customer’s engineers use to drive Claude Code, Cursor, and the future-frontier-AI clients is the fabric the customer uses to drive the active operational layer. The platform-engineering roadmap that already lives inside the MCP fabric is the platform-engineering roadmap that adopts the operational tier with zero adoption friction.

The Frontier-Defensive-AI Posture Crosses Two Agent Pillars

The customer-side frontier-defensive-AI posture sits at the intersection of two agent pillars on the active operational layer.

• Security agent. Ingests the frontier-defensive-AI finding stream (Glasswing-derived findings disclosed to the public, the standard CVE / KEV / vendor-PSIRT channels, the open-source security-advisory channels, the customer’s cyber-insurance carrier advisories) in real time. Correlates every finding to the customer’s specific deployed-asset inventory. Prioritizes the remediation queue against the per-asset blast-radius and compliance-binding catalog. Surfaces every gap as an Observe-tier audit-trail entry with an Operate-tier remediation PR against the customer’s deployment pipeline, secrets-management policy, IAM-binding-correction pipeline, or configuration-drift-correction pipeline.
• Resource-operations agent. Maintains the live deployed-asset inventory across the customer’s footprint — every cloud resource, every endpoint, every container, every managed-service surface, every workflow-automation control plane (per the companion piece in this batch), every MCP-config-file surface, every package dependency, every runtime component. The inventory is the input the security agent reads to compute every per-finding correlation. The inventory has to be live (real-time-ish), accurate (cross-cloud, cross-surface), and reachable-from-the-finding-side (the security agent has to be able to compute “does the customer deploy this affected component, where, in what version, with what blast radius” as a query against the inventory).

The two agents work as a coordinated team. A security agent that ingests the finding stream without the resource-operations agent’s inventory has no correlation. A resource-operations agent that maintains inventory without the security agent’s finding stream has no signal for which assets are in elevated-attention scope this week. The 2026 frontier-defensive-AI-posture shape is the two pillars working together.

How IAN Helps: The Active Operational Layer Underneath the Frontier-Defensive-AI Capability

IAN is the AI DevOps team for cloud infrastructure, delivered as a coordinated team of specialized agents on the active operational layer. The Mythos Preview + Project Glasswing announcement is the empirical case for the customer-side category IAN has been building toward across 2026.

• Security agent finding-ingestion channel. The security agent ingests every public Glasswing-derived finding, every CVE / KEV / vendor-PSIRT channel update, every open-source-security-advisory channel update, every cyber-insurance carrier advisory in real time. Correlates every finding to the customer’s deployed-asset inventory. Prioritizes the remediation queue against the per-asset blast-radius and compliance-binding catalog.
• Resource-operations agent deployed-asset inventory. The resource-operations agent maintains a live inventory of every cloud resource, every endpoint, every container, every managed-service surface, every workflow-automation control plane, every MCP-config-file surface, every package dependency, and every runtime component across the connected accounts. The inventory is the input the security agent reads to compute every per-finding correlation.
• Capability-tier governance per finding action. Observe-tier scans (finding ingestion, per-finding correlation, per-asset reconciliation, per-asset inventory maintenance) run automatically. Operate-tier remediations (deployment-pipeline trigger, configuration-drift correction, secrets-rotation, IAM-binding correction, auto-PR generation) require pre-authorization once. Administer-tier actions (high-blast-radius finding remediation against production, organization-wide policy edits, separation-of-duties exception grants) require explicit human approval with separation-of-duties.
• BYOK on model keys. Customers bring their own Anthropic / OpenAI / future-frontier-vendor keys. The agent layer does not see frontier-defensive-AI-driven posture as an LLM-call-markup opportunity. Pricing is usage-based on orchestration actions, with a monthly minimum. The customer’s frontier-AI spend is decoupled from the orchestration-layer spend.
• MCP-first interface. The IAN agent team is reachable from Claude, Claude Code, Cursor, and any MCP-compatible client. The same MCP fabric the customer’s engineers use to drive the frontier-AI clients is the fabric they use to drive the operational tier. Zero adoption friction.
• Immutable audit trail. Every finding, every correlation, every remediation, every exception, every Administer-tier approval lands in the customer’s per-tenant audit-trail store. The audit trail is the institutional memory of the customer’s frontier-defensive-AI-driven security posture.

The Three-Phase Rollout

Phase 1 — Observe the deployed-asset and finding-ingestion baseline. Run the security and resource-operations agents in Observe mode against the connected cloud accounts, endpoint fleets, container runtimes, workflow-automation control planes, and MCP-config-file surfaces. Produce the deployed-asset inventory, the historical CVE / KEV finding-correlation backlog, the per-asset blast-radius catalog, and the per-asset compliance-binding catalog. Configure the finding-ingestion channel against the customer’s chosen frontier-defensive-AI feed (Glasswing-public-disclosure stream, vendor-PSIRT, CVE / KEV, open-source-advisory). Two-to-four weeks.

Phase 2 — Codify the per-tier scope and promote to Operate-tier. Pre-authorize the Operate-tier scope for the deployment-pipeline trigger, configuration-drift correction, secrets-rotation, IAM-binding correction, and auto-PR generation. Codify the per-finding-class capability-tier mapping. Codify the Administer-tier approval policy for high-blast-radius production remediation, organization-wide policy edits, and separation-of-duties exception grants. Two-to-three months.

Phase 3 — Cross the security / resource / deployment / cost agent loop. Every ingested finding feeds the deployment-agent’s patch-window planner. Every per-finding correlation feeds the resource-agent’s tag-and-lifecycle pass. Every remediation feeds the cost-agent’s spend-regression watch. The team coordinates as a team. The cross-pillar context is the active operational layer.

The 2026-04-07 Mythos Preview + Project Glasswing announcement is the empirical case that the frontier-defensive-AI capability has arrived. The structural lesson is that the discovery primitive at the front is a separate layer from the operational tier at the back, the customer-side leverage is on the operational tier, and the shape that responds is the active operational layer — a coordinated team of specialized agents that runs continuous posture across the customer’s specific deployed-asset inventory, with BYOK on the model keys, capability-tier governance on every remediation, an immutable audit trail across every finding, and humans in the loop only where judgment matters. That is the shape IAN delivers.

Get a free infrastructure audit → | See pricing →