1. Insights

AI-powered cyber threats: a race against time?

  • Insight Article 10 June 2026 10 June 2026

  • UK & Europe

  • Insurance

As coding, reasoning and tool-use capabilities improve by frontier AI systems, the time needed to identify and exploit software weaknesses may reduce. For organisations already managing legacy systems, patching backlogs and complex supplier dependencies, the question is whether existing cyber resilience arrangements can move quickly enough.

Cyber risk has always involved a race between attackers finding weaknesses and defenders fixing them. AI may now be changing the speed of that race.

Anthropic has now launched Claude Mythos 5, alongside Claude Fable 5, a Mythos-class model made available for general use with additional safeguards. Mythos 5 is being deployed through Project Glasswing to selected cyber defenders and critical software infrastructure providers, while Fable 5 shows how some Mythos-level capabilities are beginning to move beyond a closed preview environment. Together, the releases illustrate how far frontier AI systems have come in coding, reasoning and autonomous task execution, including for defensive cyber security work such as the identification and remediation of vulnerabilities in critical and widely used software.

The issue is now also firmly part of the regulatory and policy conversation. The ICO has published a new blog setting out practical steps for organisations, warning that cyber criminals are increasingly using AI to carry out attacks that are faster, more advanced and harder to detect. Its examples include AI-generated phishing, deepfake social engineering, automated vulnerability scanning and exploitation, AI-powered malware, credential stuffing and password attacks, data poisoning and indirect prompt injection.

The King's Speech on 13 May 2026 reconfirmed the Cyber Security and Resilience Bill as part of the Government's legislative programme to improve the UK's defences against cyber-security threats. The accompanying briefing notes placed the Bill within the wider national security agenda. Separately, in an open letter to business leaders on AI cyber threats, DSIT and the Cabinet Office referred to Anthropic’s Mythos model and the AI Security Institute’s evaluation of its cyber capabilities as part of the changing cyber threat environment.

Recent incident data supports the concern that organisations have less time to respond, while also showing why the issue should not be framed as AI replacing familiar cyber threats. Verizon’s 2026 Data Breach Investigations Report (DBIR) analysed more than 31,000 incidents and more than 22,000 confirmed data breaches, and reported that exploitation of vulnerabilities had overtaken use of stolen credentials as the leading initial access vector, accounting for 31% of breaches compared with 13% for stolen credentials. At the same time, familiar human and identity-led risks remain material, and AI’s most immediate impact may often be to increase the scale, speed and quality of existing attack techniques rather than to create entirely new ones.

What has changed?

Anthropic describes Project Glasswing as an initiative to secure critical software using Claude Mythos Preview, with Claude Mythos 5 now launched as an upgrade for selected cyber defenders and critical software infrastructure providers. In parallel, it has released Claude Fable 5, described as a Mythos-class model for general use, with safeguards that route certain cybersecurity, biology and chemistry, and model-distillation requests to Claude Opus 4.8. Project Glasswing’s partners include major technology, cyber security, financial services and open-source organisations, with access extended to additional organisations that build or maintain critical software infrastructure.

Anthropic says Mythos Preview has identified thousands of zero-day vulnerabilities, across critical software, with findings being reviewed, disclosed and remediated through selected defensive partners. A zero-day vulnerability is a security weakness that is not yet known to, or has not yet been fixed by, the software vendor. It is particularly difficult for organisations because a ready-made fix may not exist at the point the weakness is discovered.

However, the UK AI Security Institute’s evaluation of Claude Mythos Preview recognised important limits: its ranges lacked active defenders and defensive tooling, and the results did not prove that the model could attack well-defended real-world systems. Nonetheless, the direction of travel is clear: frontier AI capability is improving in a way that may compress the time between vulnerability discovery, validation and exploitation.

For organisations, that makes timing more important. Vulnerability management, emergency patching, supplier assurance, incident response and regulatory notification all depend on having enough time to assess and act. If AI reduces that time, existing weaknesses become more consequential. That timing pressure is already visible in patching data: reporting on Verizon’s 2026 DBIR indicates that the median time for full patching/remediation increased to 43 days, while only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalogue were fully remediated in 2025.

What does this mean for organisations?

1. Vulnerability discovery may become less scarce

Finding serious vulnerabilities has historically required specialist skill, time and persistence. If AI lowers those barriers, more vulnerabilities may be found more quickly, including in code that has already been reviewed by humans or tested by conventional tools. Organisations should therefore revisit how they identify, prioritise and escalate vulnerabilities, particularly where they affect internet-facing systems, critical services or high risk data.

If AI-assisted tooling accelerates vulnerability discovery or exploit development, vulnerability management processes that are slow, under-resourced or heavily dependent on manual triage may become a more significant source of exposure.

2. Patching windows may shrink

If vulnerabilities can be identified, validated and weaponised faster, organisations may have less time to respond. The issue is not simply that organisations should “patch faster”. Patches may not yet exist, testing may take time, and temporary mitigations may involve operational and commercial decisions as much as technical ones.

Where patching cannot be immediate, organisations should be ready to deploy compensating controls. These may include segmentation, monitoring, hardening and detection. Security teams should also test whether emergency change processes can operate at the speed required during a fast-moving incident.

3. AI is changing access risk and social engineering

Many serious incidents still begin with the usual compromised credentials, supplier access, weak authentication, excessive privileges or social engineering.

The evidence base also points to acceleration in familiar social engineering techniques. CrowdStrike reported a 442% increase in voice phishing between the first and second halves of 2024. Hoxhunt’s simulated phishing research found that AI-generated spear phishing moved from being 31% less effective than human red teams in 2023 to 24% more effective by March 2025. These figures do not mean all serious cyber attacks are now “AI-led”. They support the narrower point that AI can make familiar attack methods more convincing, scalable and accessible.

To attack or to defend?

The same capabilities that help defenders identify and fix vulnerabilities could, if more widely available without adequate controls, help attackers automate parts of vulnerability discovery, exploit development, scanning and targeting.

With the launch of Fable 5 and Mythos 5, Anthropic is effectively separating broader access to Mythos-class capability from more sensitive cyber security capability, while continuing to place Mythos 5 in the hands of selected defenders first so that vulnerabilities in critical software can be identified, disclosed and remediated before comparable capabilities become more widely available.

There is a clear defensive upside. AI-enabled security tools may help software maintainers and security teams find weaknesses earlier, remediate at greater scale and improve secure-by-design practices. However, if similar capabilities become more widely available, attackers may be able to use them to increase the speed and scale of familiar attack activity.

It is also important to keep that risk in perspective. Picus Security’s Red Report 2025 analysed over 1 million malware samples and mapped more than 14 million malicious actions, identifying 11 million instances of MITRE ATT&CK techniques (a widely used framework for categorising common cyber attacker tactics and techniques). It found that the top 10 MITRE ATT&CK techniques appeared in 93% of malicious actions, suggesting that many attacker behaviours remain familiar even as tooling improves.

Closing thoughts

Claude Mythos 5 and Claude Fable 5 are best understood as a visible sign of where the market may be heading: towards greater automation, faster iteration, differentiated access to high-risk capabilities and increased pressure on the time available to respond.

The practical question for organisations is straightforward. If AI shortens the time between discovery and exploitation, can governance, patching, supplier management and incident response processes still function at the required speed?

Those that answer that question now will be better placed when AI-powered cyber threats become less exceptional and more routine.

Source notes

End

Authors:

Seaton Gordon

Seaton Gordon

Partner

Themes:

Additional authors:

Hasith Balapatabendi, Associate

Stay up to date with Clyde & Co

Sign up to receive email updates straight to your inbox!

Subscribe here