Anthropic's red team research shows that the Claude Mythos Preview AI model can turn publicly disclosed (N-day) vulnerabilities into working exploits in under an hour, a significant reduction from the weeks or months typically required by human attackers. The model successfully generated 8 exploits in approximately 12 hours across 16 Windows patches and 8 exploits across 18 Firefox patches, demonstrating consistent effectiveness across different codebases. This capability represents a phase change in exploit generation, with Mythos Preview outperforming previous AI models. The research underscores that patched vulnerabilities are no longer safe by default, as the window between disclosure and exploit has collapsed from months to hours. This elevates the importance of continuous and rapid patching in enterprise environments. Anthropic has partnered with Verizon to track AI-enabled exploitation as a distinct threat vector in the 2026 DBIR.

The rapid generation of working exploits from publicly disclosed vulnerabilities drastically shortens the time attackers need to weaponize vulnerabilities, increasing the risk of exploitation before organizations can apply patches. Enterprises that typically take 60–90 days to patch are exposed to a significantly higher risk window. This shift challenges traditional patch management strategies and elevates the urgency for automated and continuous patching solutions. The threat affects all organizations relying on timely patching to mitigate known vulnerabilities. AI-enabled exploitation is now recognized as a measurable and emerging threat vector alongside established threats like ransomware.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. However, the research emphasizes that traditional patching timelines are insufficient against AI-accelerated exploit generation. Organizations should prioritize reducing patch deployment times and consider implementing continuous automated patching solutions to minimize exposure. Monitoring vendor advisories for updates on mitigation strategies against AI-enabled exploitation is recommended. No specific patches or fixes are associated with this AI capability itself, as it leverages existing public vulnerability information.