Time to Put on Our Big Boy/Girl Pants: The Software Industry's Security Reckoning Is Here

I had some version of the same conversation at least a dozen times in 2025.

Someone on the engineering team raises concerns about using AI to help write code. The objection is always some variation of the same thing: "AI makes mistakes. We can't trust it." I listen. I nod. And then I remind them of our bug backlog.

The backlog is longer than anyone would like. It has always been long at every company I have worked for. It is long because software is extremely complicated and humans make mistakes too. Unfortunately, we have spent decades building entire disciplines around the polite fiction that if we just hire better developers, run more tests, and buy more scanners, we will eventually close the gap. Almost none ever do. The backlog is the hard proof.

I am not telling that story to criticize our engineering teams. I have spent most of my career running engineering teams, and the ones I have worked with have always wanted to improve by using new tools, programming languages, frameworks, and processes. I am telling it because it is the conversation the entire software industry needs to come to terms with. We are not losing the security war because we lack desire or effort. We are losing it because writing secure software is beyond the capabilities of just about all of us.

That conversation just got a lot harder to avoid.

What Mythos Changed

On April 7, 2026, Anthropic announced Claude Mythos Preview. It is not a specialized security tool. It is a general-purpose model that, during internal testing, turned out to be the most capable vulnerability discovery engine ever built. In Anthropic's own words, it can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.

The numbers are not subtle. In pre-release testing, Mythos identified thousands of previously unknown zero-day vulnerabilities across every major operating system and every major web browser. It developed working exploits on the first attempt in over 83% of cases. It executed multi-stage attacks on vulnerable networks autonomously. It chained together sequences of individually minor flaws into critical exploits, held massive amounts of context simultaneously, and corrected its own errors in recursive loops, all at a speed and scale that no human team can match.

Steve Gibson, host of the Security Now podcast and one of the sharpest security minds I follow, described reading Anthropic's technical disclosure and finding nothing to dismiss. The skeptics calling it marketing hype, he noted, did not appear to have read the actual findings. Where Anthropic claimed a serious discovery, they committed to it publicly using SHA256 hashes of their full private disclosures, a verifiable proof of what they found and when, while responsible disclosure kept the details under wraps. That is not the behavior of a company blowing smoke.

The Evidence Was Already There

Here is what Mythos actually revealed: this was not a new problem. It was an old problem that we could no longer look away from.

Consider OpenBSD. If you had to name one operating system built specifically around security, it would be OpenBSD. It runs firewalls. It runs critical infrastructure. Its developers are famously rigorous. It had a vulnerability sitting in its TCP SACK implementation since 1998, a 27-year-old integer overflow that lets an attacker remotely crash any OpenBSD host with two packets. It survived millions of automated fuzz tests and multiple rounds of expert security review. Mythos found it autonomously for less than $50 in compute.

Then there is Firefox. Mozilla operates one of the most respected security programs in open source software. In a single evaluation pass with Mozilla's security team, Mythos found 271 security vulnerabilities. The fixes shipped in Firefox 150 on April 21, 2026. Mozilla's own conclusion: Mythos was as capable as the world's best security researchers, with no category of vulnerability identified by humans that it could not also detect.

I anticipate the objection: those are old codebases. Legacy software. Not representative of modern development practices. Except macOS has them too. Linux has them. These are not legacy projects managed by teams cutting corners. They are actively maintained products with modern AppSec practices, and they are full of holes.

Security bugs are not a symptom of negligent development. They are a symptom of complexity exceeding human cognitive throughput. That is a very different problem, and it requires a very different response.

The Math Does Not Add Up

If we were winning this fight, the numbers would show it. They do not.

According to a study commissioned by JFrog and conducted by IDC, organizations spend an average of $28,000 per developer per year on security-related tasks. That works out to roughly 19% of a developer's time, just identifying, evaluating, and addressing security concerns. Not building features. Not shipping product. Reviewing scanner findings, triaging alerts, and chasing vulnerabilities. The same study found that developers spend an average of 3.5 hours per week doing nothing but manually reviewing scanner output because of false positives and duplicates.

Meanwhile, IBM's 2025 Cost of a Data Breach Report found that the average US data breach now costs $10.22 million, an all-time high.

We are spending one-fifth of our developers' working lives on security and still producing software that a general-purpose AI can crack open in hours. At some point, the honest response to that equation is not to ask for more budget. It is to ask whether the approach is fundamentally wrong.

What We Are Asking Humans to Do

Some of what made Mythos extraordinary is not exotic. It is the new baseline for what a serious adversary will bring to bear.

Multi-vulnerability attack chains require holding the context of an entire system simultaneously, understanding how individually minor weaknesses interact, and reasoning about the cumulative effect. Intent-based code reasoning means understanding not just what a piece of code does but what the developer intended it to do, and finding the gap between those two things. Recursive self-correction means running an exploit, learning from the failure, adjusting, and retrying, over and over, without fatigue or frustration.

Even the best human red teamers cannot sustain that kind of analysis across millions of lines of code. It is not a question of skill. It is a question of scale. The attack surface of modern software has simply grown beyond what human attention can cover.

We would not ask a team of architects to personally inspect every weld in a modern skyscraper. We would automate and use instruments designed for the job. Security is overdue for the same reckoning.

Accepting This Is Not Defeat

The industry's reflex here is to treat this as a threat. It is actually an instruction manual. Mythos and the models that follow are not the crisis. They are the clearest argument anyone has ever made for why the current approach to security has to change.

Adversaries will have Mythos-class capabilities within six to eighteen months, by Anthropic's own estimate. OpenAI is building comparable tools. Microsoft is building a multi-model harness. The window for defenders to get ahead of this is narrow and closing. The organizations that come out ahead will not be the ones that waited to see how it played out. They will be the ones that looked at what Mythos demonstrated and immediately asked: how do we put this on our side?

That means responding on two fronts simultaneously. The first is defending what already exists. AI-powered discovery at this scale changes the volume of findings dramatically. Thousands of zero-days in a single pass is not an edge case. It is a preview of what enterprise security teams will be managing when these capabilities reach the broader market. The bottleneck will not be finding vulnerabilities. It will be operationalizing what gets found: ingesting it, prioritizing it against actual business context, routing it to the right teams, and tracking remediation at a pace that matches the rate of discovery. The second is shifting left. Mythos did not just prove that AI can find security issues. It proved that AI must review code, regardless of who or what wrote it. Those raising concerns about AI-generated code creating new vulnerabilities are not wrong, but they are missing the point. The answer to AI writing insecure code is not to write less code. It is to stop treating AI-assisted validation as optional.

The organizations building that operational muscle now, with unified data, AI-powered risk prioritization, and automated remediation workflows, are the ones who will be ready when the volume arrives. The ones still relying on manual triage and spreadsheet tracking will not be.

There is a version of this conversation where the software industry spends the next two years debating whether AI is ready to be trusted with security. That debate already happened. Mythos settled it.

Mythos didn't break software security. It just stopped letting us pretend it wasn't already broken.

FAQs