The Arms Race Just Changed

About this guide

Every chapter stands on its own. If you lead a security program and have twenty minutes, read Chapter 4 (patching), Chapter 5 (machine identity) and Chapter 9 (the checklist). If you need to brief a board, Chapter 1 and the board section of Chapter 6 give you the data and the framing. If you run an AppSec or red team, Chapters 2 and 3 are the technical core.

Two conventions run through the book:

• Reported facts carry their source. Numbers come from named reports, vendor disclosures or incident write-ups, listed on the Sources page at the end.
• Analysis is labeled as analysis. Where I forecast, estimate or recommend, I say so. Treat those sections as one practitioner's judgment, not as findings.

This edition reflects public information available through early November 2026. The landscape moves monthly, and I will update the guide as the data changes.

The model Anthropic decided not to sell

On April 7, 2026, Anthropic announced a model it decided not to sell.

Claude Mythos Preview had found thousands of zero-day vulnerabilities across every major operating system and every major web browser. One of them, a remote crash bug in OpenBSD's TCP code, had been sitting there for 27 years. Another, in FFmpeg's H.264 decoder, was 16 years old, on a line of code fuzzers had executed five million times without triggering it. Given known vulnerabilities in Firefox 147's JavaScript engine, the model produced 181 working exploits. Claude Opus 4.6 produced two.

Instead of a general release, Anthropic launched Project Glasswing: a restricted program giving a small group of vetted organizations, including AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, access to the model for defensive work.

That was the headline. Seven months later, the more useful story is what happened after it.

Seven Months of Evidence

When the announcement landed, most of the commentary was speculation. We now have data.

• Discovery scaled faster than anyone predicted. Anthropic reports that Glasswing partners verified at least 129,000 vulnerabilities between April and July 2026, more than 33,000 of them rated critical or high. Its own open-source scanning added another 5,500 through October. Anthropic says even that is an undercount, because it comes from survey data from only some of the partners.
• Fixing did not scale. As of October 2, maintainers had patched 516 of the 6,157 open-source vulnerabilities Anthropic had disclosed to them, according to Anthropic's own count. Discovery is no longer the bottleneck. Remediation is.
• The capability spread. Mythos Preview became a model family. Mythos 5 and a safeguarded general-availability sibling, Fable 5, shipped in June. Version 5.1 of both followed in September. In October, Anthropic folded Glasswing into a broader Cyber Verification Program with three access tiers for vetted defenders.
• Autonomous intrusion stopped being hypothetical. In July, Hugging Face disclosed an intrusion it described as "driven, end to end, by an autonomous AI agent system." The agent got in through the dataset processing pipeline, harvested service credentials and moved through internal systems with no human at the keyboard. Responders reconstructed more than 17,000 recorded events.
• AI is now routine in breaches. IBM's 2026 Cost of a Data Breach Report found attackers used AI in one in four malicious breaches, a 56% jump in a year, at an average cost of about $6 million per AI-enabled breach.

The same months also produced a useful counterweight. VulnCheck reviewed 1,061 publicly attributed AI-assisted vulnerability discoveries and found 14 of them, 1.3%, exploited in the wild by mid-2026: about the same rate as for vulnerabilities in general. The flood of discovered bugs has not yet turned into a flood of exploitation.

That gap is the most important fact in this book. It is a window, and windows close.

The Thesis

My position is simple, and every chapter builds on it:

Attackers will use AI more, faster and more cheaply than defenders. The organizations that prepare now, with the right knowledge, tools and identity controls, will hold a durable advantage. The ones that wait will spend 2027 reacting.

I do not believe AI hands attackers a permanent win. Defenders know their own systems, control their own environments, and every bug they fix stays fixed. Those are real structural advantages. But they only pay off for teams that move at the new speed.

The real story is not that AI can find bugs. Fuzzers found bugs. Static analysis found bugs. The real story is three changes happening at once:

1. Discovery got cheap. A vulnerability campaign that once took a specialist months now runs in hours for a compute bill in the thousands of dollars.
2. Exploitation got composable. Models chain several low-severity flaws into one critical attack path, which most vulnerability management programs are structurally blind to.
3. Identity became the soft target. AI agents run on API keys, service accounts and tokens that nobody inventories, rotates or monitors. The Hugging Face intrusion was, underneath, a credential problem.

Who This Guide Is For

This is not a beginner's guide. It assumes you know what a CVE is, how a SOC runs and why least privilege matters.

It is written for:

• CISOs and security leaders deciding where the next dollar and the next hire should go.
• Security architects redesigning defense in depth for an environment where exploits arrive in hours.
• AppSec and red team leads who need to understand how AI discovery actually works so they can use it first.
• Engineering leaders who own patch pipelines and the AI agents their teams are shipping.
• Board members and executives who need to understand why "our scans are clean" no longer means what it used to.

What You Will Learn

Chapter 1 maps the threat landscape with 2026 data from CrowdStrike, IBM, Verizon and Mandiant, and explains why the economics of attack research shifted by orders of magnitude. Chapter 2 opens the hood on agentic vulnerability discovery: how a model reads code, forms hypotheses, tests them and confirms real bugs, and how the same loop pointed at live infrastructure becomes an autonomous intrusion.

Chapter 3 covers vulnerability chaining, the capability that turns three "medium" findings into one critical compromise, and why CVSS-driven programs miss it. Chapter 4 looks at the patch bottleneck with real remediation data and gives you a tiered model for getting critical fixes out in 72 hours.

Chapter 5 is the chapter I most wanted to write. It explains why identity systems designed for humans cannot govern AI agents, walks through the Hugging Face breach as a machine identity failure, and gives you a governance framework with code. Chapter 6 turns everything into a five-phase plan with budgets, vendor criteria and board framing.

Chapter 7 tells the full story of Project Glasswing, from launch to the Cyber Verification Program, including what it got right and what it left unsolved. Chapter 8 covers the people side: skills, training tiers and building an internal AI red team. Chapter 9 is a scored readiness checklist you can run with your team this week. Chapter 10 is my forecast for 2027, clearly labeled as analysis.

Why I Wrote This

I have spent most of my career in cybersecurity and digital identity. I founded a CIAM platform and scaled it to more than a billion users. At that scale, every authentication request, every token and every API call is adversarial terrain, and you learn quickly that attackers adapt before defenders do.

I also learned that identity is the layer everything else depends on. You can patch every server in the fleet, and if a long-lived, over-privileged credential is sitting in a config file, none of it matters. That lesson is why this book spends as much time on machine identity as it does on vulnerabilities. Most AI security writing in 2026 focuses on the model finding bugs. Far less of it focuses on what the model, or the agent, does with the credentials it finds next.

Today I run GrackerAI, a company I started in 2024. None of that makes my forecasts right. It does mean I have built and defended these systems, not just written about them.

For background on how AI capabilities are evolving more broadly, my essay on the future of AI and its impact and my Grok AI hub on frontier model competition are good companions to this guide.

A Note on Speed

Some numbers in this book will be out of date within months. That is the point. The goal is not to memorize statistics. It is to build an organization that notices when the numbers change and responds in days, not quarters.

The question I want you holding while you read is a simple one: if a working exploit for your most critical system appeared four hours from now, what would actually happen next?

Let's find out.

Key takeaways

• AI-scale vulnerability discovery is real: Glasswing partners verified at least 129,000 vulnerabilities between April and July 2026.
• Remediation, not discovery, is now the bottleneck: about 8% of the open-source findings Anthropic disclosed were patched upstream by October.
• Exploitation of AI-found bugs is still near the baseline rate, which makes the next months a window to fix your pipeline.
• The first autonomous agent intrusion on record, at Hugging Face, became serious because of the credentials the agent found.