SANS, OWASP, and Cloud Security Alliance Issue Emergency Briefing as AI-Driven Exploits Compress Vulnerability Timelines From Weeks to Hours
A coalition of cybersecurity heavyweights warns that AI-driven vulnerability discovery has collapsed mean time-to-exploitation to under one day, urging CISOs to deploy AI agents against their own code immediately.
Overview
The SANS Institute, Cloud Security Alliance, OWASP GenAI Security Project, and security consultancy [un]prompted released a joint emergency strategy briefing on April 14 titled “The AI Vulnerability Storm: Building a Mythos-Ready Security Program,” warning that AI-driven vulnerability discovery has compressed the mean time from disclosure to confirmed exploitation to less than one day in 2026, according to the joint announcement. That figure stood at 2.3 years in 2019.
The 30-page document, produced over a single weekend by more than 60 named contributors and reviewed by over 250 CISOs, concludes that organizations are “likely to be overwhelmed” by threat actors using AI to find and exploit vulnerabilities faster than defenders can patch them, as CyberScoop reported.
The briefing responds directly to the capabilities demonstrated by Anthropic’s Claude Mythos model and its associated Project Glasswing coordinated disclosure initiative. As previously reported by The Machine Herald, Mythos first came to light through an accidental data leak in late March.
What We Know
The briefing documents a rapid escalation in AI offensive capabilities over the past year. In June 2025, the autonomous system XBOW became the first AI to top HackerOne’s US leaderboard, outperforming all human hackers on the platform. In August 2025, DARPA’s AI Cyber Challenge identified 54 vulnerabilities across 54 million lines of code in four hours. By November 2025, Anthropic disclosed that a Chinese state-sponsored group had used AI to autonomously execute full attack chains, from reconnaissance through data exfiltration, across approximately 30 global targets. In February 2026, Anthropic reported discovering more than 500 high-severity vulnerabilities in open source software using Claude Opus 4.6, according to the announcement.
Mythos itself represents a step change beyond those earlier milestones. The model generated 181 working exploits against Firefox vulnerabilities where Claude Opus 4.6 produced only two, a roughly 90-fold improvement, per the CyberScoop report. It achieved a 72 percent exploit success rate with the ability to chain vulnerabilities autonomously, according to the joint announcement. In Capture the Flag exercises, Mythos solved nearly 73 percent of expert-level problems, whereas no large language model could complete any prior to April 2025, CyberScoop reported.
The UK’s AI Security Institute tested Mythos independently and determined the model is “at least capable” of autonomously compromising smaller, weakly defended enterprise networks, though testing lacked active defenders and real-world security alerts, according to CyberScoop.
What the Briefing Recommends
The strategy document includes a 13-item risk register mapped to four industry frameworks: the OWASP LLM Top 10 2025, OWASP Agentic Top 10 2026, MITRE ATLAS, and NIST CSF 2.0. Alongside it sits an 11-item priority actions table, 10 diagnostic questions for CISOs, and a board-ready executive briefing section, according to the announcement.
The first priority action is blunt: deploy AI agents against your own codebase this week. The eleventh and final action calls for establishing a permanent Vulnerability Operations function within 12 months, per the joint announcement.
“The window between vulnerability discovery and weaponization has collapsed into hours,” Rob T. Lee, SANS Chief AI Officer, stated in the announcement.
Who Contributed
The briefing drew contributors from across the cybersecurity establishment, including former CISA Director Jen Easterly, former National Cyber Director Chris Inglis, former NSA Cybersecurity Director Rob Joyce, cryptographer Bruce Schneier, Google CISO Heather Adkins, and Luta Security CEO Katie Moussouris, according to CyberScoop. The lead authors were Gadi Evron (Knostic CEO), Rob T. Lee (SANS), and Rich Mogull (Cloud Security Alliance Chief Analyst), per the announcement.
What We Don’t Know
The briefing warns of a coming “patch tsunami” when Anthropic’s full Glasswing vulnerability report lands in early July 2026, but neither the briefing nor Anthropic has disclosed the exact number of zero-day vulnerabilities identified across operating systems and browsers, according to CyberScoop. Over 99 percent of the vulnerabilities Mythos has identified have not yet been patched, per CyberScoop.
The briefing also notes that EU AI Act enforcement begins in August 2026, which could shift negligence standards for organizations that fail to adopt AI-driven defensive tooling, but the exact regulatory implications remain unclear, according to the announcement.
Whether the speed of corporate bureaucracy can match the pace of AI-accelerated offense remains the central question. As CyberScoop noted, corporate consensus-building, hierarchies, and compliance processes slow AI defense integration relative to attacker adoption speed, creating an asymmetry the briefing acknowledges but cannot resolve.