"N-hour is closer to the reality we now operate in," Anthropic's red team told researchers — and the data in their tests makes that plain.
Claude Mythos turned patches into exploits in under an hour
The old assumption — that reverse‑engineering a patch into a working exploit takes weeks — no longer holds, according to experiments cited in the source. Anthropic's Claude Mythos Preview, given only a public diff and two builds, converted 18 Firefox patches into 8 working code‑execution exploits. Its first exploit was produced in under an hour, and crucially the Firefox release carrying that fix was still 18 days away from shipping.
Similar capability targeted Windows kernel bugs even without source code: using stripped binaries and decompiler output, the Claude models produced proof‑of‑concept crashes for 18 out of 21 kernel bugs (the fastest in 31 minutes) and chained 8 of them to SYSTEM at an estimated cost of roughly $2,000 each. One of those SYSTEM chains exploited a bug Microsoft had tagged "Exploitation Unlikely" — a rating calibrated for human researchers but suddenly unreliable in the face of these tools. The public Claude models, with safeguards enabled, produced fewer exploits but still produced some, showing this is not a capability locked behind a single gated model.
"Every patch is a confession" — why disclosure now arms attackers
The article frames the problem bluntly: the patch that fixes a bug also hands attackers a roadmap to it. Researchers have named the inflection point "Vulnpocalypse" — the moment a model can weaponize a disclosure faster than defenders can deploy the fix. Historically, defenders could rely on a multi‑week gap between patch and public exploit; the Anthropic results collapse that gap to hours in many cases.
That asymmetry is amplified by operational realities: patches wait for regression testing, change windows, and uptime commitments. With roughly 135 new CVEs per day — currently up about 40 percent year over year — teams face a backlog no human force can eliminate quickly enough.
Measurement: time to patch versus time to exploit
Two industry measurements in the piece underline the new risk calculus. Verizon's 2026 DBIR reports a median time to fix a known‑exploited flaw of 43 days, up from 32 the year before, and finds only 26 percent of such flaws are ever fully patched. Even the best performers close just 30 to 40 percent of known‑exploited vulnerabilities in the first week. By contrast, the Zero Day Clock shows 2026's average time‑to‑exploit at less than 24 hours, down from about 53 days in 2024.
Put together, those figures show defenders are increasingly likely to be caught in the gap between disclosure and safe, fully validated deployment — the precise interval that autonomous tools now compress for attackers.
Picus's alternative: validate exploitability, don't assume it
The central prescription in the source is a shift from "are we patched?" to "are we secure right now, and can you prove it?" Picus Security presents a three‑part validation loop intended to answer that question without trying to win a losing race on pure patch speed.
- Autonomous Penetration Testing: where it is safe to detonate an exploit, Picus runs real chains against reachable assets to produce the strongest proof of exposure.
- Exposure Validation: for the 85–90 percent of assets you cannot safely touch — restricted networks, air‑gapped systems, or business‑critical hosts — Picus decomposes a CVE into its required TTP chain and validates each link against your actual controls, allowing a day‑one answer without detonation.
- Breach and Attack Simulation: continuously test the live prevention and detection stack against the newest techniques, find where controls have drifted, and produce the exact signature or rule to close the gap, then re‑validate.
The loop is driven by "Picus Swarm," described as a team of AI agents operating inside customer guardrails, with a traceable chain of custody and no opaque scores or hallucinated attack paths. Picus cites customer outcomes: 92% fewer SLA violations on high and critical findings, 89% lower MTTR, and 2x control effectiveness in three months.
What this means for security teams, boards, and procurement
Security teams: the article argues you cannot meaningfully outrun modern exploit creation by simply patching faster. Instead, run validation that shows which exposures are actually exploitable against your controls and prioritize mitigations that change the outcome.
Boards and procurement leaders: the board question, the piece says, should move from "are we patched?" to "are we secure right now, and can you prove it?" That framing shifts spending toward validation and control effectiveness rather than blanket patching that may cost uptime without demonstrable risk reduction.
Authored by Sıla Özeren Hacıoğlu, Security Research Engineer at Picus Security, the source argues the decisive shift is operational: when exploit‑creation compresses from days or weeks to hours, defenders must stop assuming vulnerability equals exploitability and start proving it — continuously, and against the controls that actually stand between attackers and the crown jewels.
