Anthropic's Project Glasswing used Claude Mythos Preview to identify more than 10,000 high- or critical-severity vulnerabilities across systemically important software in a single month.
Exploit timelines: hours, not days
The source lays out a stark shift: vulnerabilities are discovered, reproduced, and weaponized faster than ever, and the window between disclosure and indiscriminate, in‑the‑wild exploitation is now measured in hours. Attackers and defenders are both using AI, but the practical consequence is asymmetric — attackers operate on timelines measured in hours while defenders still operate on timelines measured in weeks. That disparity is where exploitation occurs.
Verizon 2026 DBIR: remediation is slowing
Evidence of that operational lag appears in the Verizon 2026 DBIR: the median time for an organization to patch a critical vulnerability rose year over year from 32 days to 43 days. The report from that source is used to underline a simple, brutal fact in the piece: remediation and patching have not kept pace with AI-driven vulnerability discovery and exploitation.
India's CERT‑IN guidance and regulatory pressure
Regulators are pushing for faster action. India's CERT‑IN recently issued guidance that points toward sub-day patching expectations for certain critical vulnerabilities. The article argues the intent of such guidance is clear, but that it clashes with operational realities — uptime requirements, stability testing, change windows, business approvals, compliance obligations, and the simple fact that production systems cannot be broken in the name of urgency.
Three-step operating model: Preempt, Validate, Mitigate
The practical response the source prescribes is an operational shift that accepts some vulnerabilities will be targeted before they can be fully remediated. The recommended three-step model is:
- Preempt what attackers are likely to exploit — filter disclosures quickly to identify the subset with traits attackers favor: broad deployment, internet reachability, repeatable exploitation, and a clear path to meaningful access.
- Rapidly react and validate exposure — determine, on an environment‑specific basis, whether the organization uses the technology, whether the vulnerability is theoretical or exploitable within the environment, where exposed systems sit, and who owns them. Validation answers whether the vulnerable component is reachable and exploitable in the real world.
- Mitigate to buy time for remediation — apply temporary controls such as access restrictions; disabling vulnerable functionality; WAF or API rules; IDS/IPS updates; isolation; configuration changes; focused monitoring; or other temporary controls that block exploit patterns. The controls should be informed by the exploit path, payload, required conditions, and known‑bad behavior rather than a generic CVE summary.
The article emphasizes that speed without accuracy is panic, and accuracy without speed is irrelevant. Autonomous mitigation is positioned as the only control that operates in the same timeframe as exploitation; it is intended to make exploitation slower, less reliable, and harder to scale while safe patching continues.
What this means for security teams, regulators, and vendors
- Security teams: Face a narrowing window to triage and validate disclosures. The priority becomes early filtering to find the small set of vulnerabilities likely to be weaponized, and the capacity to validate exploitability in hours, not days.
- Regulators and boards: Will continue to demand faster remediation, but the article flags a tension between sub-day expectations and operational realities such as change control and service availability.
- Vendors and solution providers: Are presented with a demand for tools that compress defender timelines — combining proactive threat intelligence, external attack surface management, and autonomous mitigation so defenders can "preempt attackers, validate emerging threat exposure, and autonomously mitigate to gain the one thing attackers can't outrun: time to respond."
watchTowr Platform: an example of autonomous mitigation
The source presents the watchTowr Platform as a specific response built to compress defender timelines. According to the material, the platform uses an attacker‑led approach to identify exploitable weaknesses and, by leveraging AI, brings together Proactive Threat Intelligence, External Attack Surface Management, and Autonomous Mitigation. The stated purpose is to show teams what attackers can see, what they can exploit, and what can be done to mitigate before compromise. Patching remains described as necessary and essential — but insufficient alone in an AI‑driven exploitation environment.
The result the piece leaves on the table is concrete: AI is industrializing vulnerability research for all sides, disclosure volumes and attack speed are increasing, and organizations that cannot compress detection-to-mitigation timelines risk being overtaken. The practical choice offered is operational: accept that some vulnerabilities will be targeted before full remediation and adopt preemptive validation plus temporary, accurate mitigations to buy the time safe patching requires.
https://thehackernews.com/2026/06/ai-driven-exploitation-is-destroying.html
