# AI-Speed Exploitation: When 73 Seconds to Breach Exposes the Myth of Patching
## The Threat
In April 2026, Anthropic quietly released Mythos, its newest frontier AI model, to a small circle of vetted partners under strict sandbox conditions. The company knew what it had built was dangerous—so dangerous it would never be released publicly. What happened next in those first two weeks destroyed a decade of conventional wisdom about vulnerability management.
Mythos identified 181 working Firefox exploits in 14 days. The previous state-of-the-art model had managed two. It surfaced thousands of zero-days across every major operating system and browser, including a vulnerability that had sat dormant in OpenBSD—an operating system whose entire security reputation rests on finding *exactly these kinds of bugs*—for 27 years. Today, more than 99% of what Mythos discovered remains unpatched in production systems worldwide.
That same month, AWS Threat Intelligence released a postmortem on a campaign that made the Mythos findings impossible to ignore: a single operator, minimal sophistication, no hands on a keyboard. An AI did the work. It compromised 2,516 FortiGate devices across 106 countries in parallel, completing attacks in minutes per target. No zero-days required. Known vulnerabilities and misconfigurations were sufficient. The attacker didn't need to be smarter—the AI just needed to be faster, and it was. This wasn't a theoretical exercise or a proof-of-concept buried in academic papers. This was active threat activity, in the wild, today.
The message is unambiguous: offense now runs at machine speed, and defense is still running on a human clock.
## Severity and Impact
| Metric | Details |
|---|---|
| Model/Framework | Anthropic Mythos (gated preview); FortiGate zero-day/known CVE exploitation |
| Scale of Findings | 181 Firefox exploits + thousands of zero-days across OS and browser ecosystems |
| Real-World Campaign Impact | 2,516 devices across 106 countries compromised in minutes |
| Current Patch Status | 99% of discovered vulnerabilities remain unpatched in production |
| CVE-to-Exploit Window (Historical) | 2.3 years (2018) → 23 days (2025) → ~10 hours (2026) |
| Attack Complexity | Minimal; known CVEs + misconfigurations sufficient without zero-day leverage |
| Operator Skill Level | Low; AI compensation eliminates expertise requirement |
| Deployment Timeline | Complete compromise in 73 seconds; seconds 0–73 broken down as: exploit (5s), MFA bypass (20s), web shell (30s), credential dump (45s), full compromise (73s) |
## Affected Products
Browser & Browser Engines:
Operating Systems & Platforms:
Network & Security Infrastructure:
Broader Scope:
The vulnerability landscape extends across the entire modern computing stack. The advisory makes clear: if it's deployed, it's likely vulnerable.
## Mitigations
### Immediate Actions (Days 1–7)
1. Abandon traditional CVE prioritization. CVSS scores and "exploitability" metrics no longer meaningfully predict real-world risk. A vulnerability with a 6.5 CVSS score is as likely to be weaponized within hours as one with 9.8. Stop using CVSS as a filter.
2. Implement continuous automated validation. Blue-side AI and automated patching without validation is guesswork at machine speed. Pair automated exploit attempts (red team simulation) with your patch deployment pipeline to validate that controls actually block known attack paths before and after patching.
3. Compress patch cycles to hours, not weeks. The 10-hour CVE-to-exploit window is not a worst-case scenario—it's the new baseline. Organizations still operating on 30, 60, or 90-day patch cycles are assuming they have time they no longer have. Establish rolling critical-patch deployment every 24 hours minimum.
4. Segment and monitor at machine speed. Human-driven network monitoring cannot detect attacks that complete in 73 seconds. Deploy behavioral anomaly detection with subsecond alerting on:
- Unexpected lateral movement
- Credential usage outside normal patterns
- Web shell creation and execution
- MFA bypass attempts
### Medium-Term Hardening (Weeks 2–4)
5. Eliminate unnecessary authentication friction. Paradoxically, the answer to machine-speed exploitation is stronger authentication, not weaker—but it must be invisible. Hardware security keys, passwordless sign-in, and certificate-based auth are faster than passwords. MFA bypass is now a baseline assumption; assume an attacker will get past it within 20 seconds of initial compromise.
6. Assume breach and design for rapid containment. If an attacker can own a device in 73 seconds, the question isn't "how do we prevent breach?" It's "can we detect and isolate it in the next 73 seconds?" Implement:
- Micro-segmentation so a compromised device cannot reach critical systems in seconds
- Automated kill switches that isolate hosts on anomaly detection
- Credential isolation so compromised user accounts cannot access everything
7. Retire the quarterly pentest model. A pentest that happens every three months is a snapshot from 90 days ago. Continuous red team simulation (automated attack execution) with validation is the only model that provides meaningful signal in a 10-hour weaponization window.
### Strategic Realignment
8. Treat patching as a continuous operational process, not a project. The distinction between "patching" and "incident response" is collapsing. Organizations need on-call patch deployment capacity 24/7/365, with automated testing and rollback. If your change management process requires a meeting before deploying a critical patch, you've already lost.
## References
---
## HackWire Analysis
The real story isn't that an AI found a lot of vulnerabilities. The story is that the entire operational model of vulnerability management—the thing we've called "defense" for twenty years—is now obsolete, and most organizations haven't noticed yet.
For decades, security has been built on a comfortable fiction: that CVSS scores predict risk, that patch cycles measured in weeks or months are acceptable, that a quarterly pentest is meaningful, that "exploitability" is a useful measurement. All of that assumes time. Time to review, time to test, time to deploy, time to recover if something goes wrong. We had months between disclosure and weaponization in 2018. We had weeks by 2024. We had 23 days by 2025. We now have ten hours. Within the next 12 months, that window will compress to hours. The mathematical trend is clear, and Mythos is just the inflection point.
The FortiGate campaign is the canary. One person, minimal skill, an AI doing the work, 2,516 devices in 106 countries before anyone noticed. And that's *now*, with AI still in early deployment. In six months, it won't be 2,516 devices. It will be 500,000. Not because attackers are smarter—because they won't need to be. The machine will do it.
What's dangerous about this advisory is not what it says; it's what most organizations will do with it. They'll bump FortiGate to their critical patch list. They'll ask Picus to download that white paper. They'll shuffle some Jira tickets. And they'll go back to their quarterly reviews and their monthly patch windows, because changing the operational model requires admitting that everything they built—the entire governance structure, the change management process, the risk committees—no longer fits the problem.
The organizations that survive the next 18 months won't be the ones with better tools. They'll be the ones that automated their defenses and gave up on the illusion of human-speed control. Autonomous validation, continuous deployment, micro-segmentation with instant isolation: that's not security theater anymore. That's table stakes.
— *HackWire Editorial*
## Related Coverage