AI models can now find and weaponise software vulnerabilities in minutes to hours instead of weeks. Anthropic’s Claude Mythos, Microsoft’s MDASH, and the multi-vendor Project Glasswing initiative are already surfacing thousands of new CVEs across major operating systems, browsers, and open-source software. The result is more patches, released more often, with less time to react. That shift is turning patch management from a monthly IT task into a continuous operational discipline. Managed patching services like Insentra’s exist specifically to absorb that new volume. <\/p>\n\n\n\n
For twenty years, Patch Tuesday has been a predictable fixture of enterprise IT. A monthly cadence. A maintenance window. A Change Advisory Board meeting. Test, approve, deploy, repeat. <\/p>\n\n\n\n
That rhythm is breaking down, not because of a process failure, but because the thing it was built to manage has fundamentally changed pace. <\/p>\n\n\n\n
AI systems are now discovering, validating and in some cases exploiting software vulnerabilities at a speed no human research team can match, and multiple major vendors, including Anthropic, Microsoft, Mozilla and the Cloud Security Alliance, are independently confirming it in 2026. The practical effect is a sharp, sustained increase in the number of security patches organisations need to assess and deploy, arriving with far less warning than before. <\/p>\n\n\n\n
Three separate but related developments are driving this shift, and it’s worth being precise about which is which, because a lot of the current commentary blends them together: <\/p>\n\n\n\n
They’re connected, but they are not the same initiative, and confusing them makes it harder to understand who is responsible for what. <\/p>\n\n\n\n
Claude Mythos is a frontier AI model from Anthropic, announced in preview form on 7 April 2026, capable of autonomously finding and constructing working exploits for software vulnerabilities at a level matching top human security researchers. Anthropic has not released it publicly. It’s currently accessible only to a limited set of partner organisations through a controlled programme called Project Glasswing. <\/p>\n\n\n\n
The reason it matters commercially, not just technically, is speed. In controlled testing against patched Firefox vulnerabilities, Mythos produced its first proof-of-concept exploit in around 12 minutes and generated 14 of 18 possible exploits within roughly three hours, eight of them full, working exploits capable of arbitrary code execution. In a separate Windows kernel privilege-escalation test using only compiled binaries (no source code), Mythos produced its first working proof-of-concept in 31 minutes and all 18 crash reproductions within six hours, including eight complete escalation chains to full system access. <\/p>\n\n\n\n
For context, the WannaCry ransomware worm took 59 days after a patch was released before attackers weaponised it. That’s the scale of compression the industry is now dealing with. <\/p>\n\n\n\n
Project Glasswing is Anthropic’s early-access initiative that gives roughly 40\u201350 major software and infrastructure providers controlled use of Claude Mythos to find and fix vulnerabilities in their own products before public disclosure. It matters to every business, not just the partners, because the vulnerabilities it finds, in operating systems, browsers, and widely used open-source libraries, affect anyone running that software, regardless of whether their organisation is directly involved. <\/p>\n\n\n\n
Anthropic has reported that Glasswing partners have collectively surfaced more than 10,000 high- or critical-severity vulnerabilities so far. In a separate exercise scanning over 1,000 widely used open-source projects, Mythos surfaced 23,019 vulnerabilities, of which roughly 6,200 were assessed as high or critical severity, a figure independently validated by external security researchers at a 90.6% true-positive rate. One of those findings, a flaw in the wolfSSL cryptography library used across billions of devices, could have allowed attackers to forge certificates for fake but convincing banking or email sites. It has since been patched. <\/p>\n\n\n\n
Public CVE disclosures stemming from Project Glasswing findings began rolling out in July 2026, and more are expected as partners work through their backlogs. <\/p>\n\n\n\n
MDASH is Microsoft’s own internally built “agentic scanning harness,” announced 12 May 2026, that runs more than 100 specialised AI agents to scan, debate and prove vulnerabilities across Microsoft’s codebase. It’s a separate system from Claude Mythos, though Microsoft is also a Project Glasswing partner using Mythos alongside it. On the public CyberGym benchmark, MDASH scored 88.45%, ahead of both Claude Mythos Preview (83.1%) and GPT-5.5 (81.8%) at the time of testing. <\/p>\n\n\n\n
MDASH’s first public disclosure surfaced 16 previously unknown Windows vulnerabilities, including four critical remote-code-execution flaws in core networking and identity components, all patched in the May 2026 Patch Tuesday release. Microsoft has also confirmed it is updating its Secure Development Lifecycle to fold AI-specific risks, such as prompt injection, agent abuse, and model behaviour that leads to data exposure, directly into how it classifies and prioritises vulnerabilities. That means Copilots, agents and model integrations are now formally inside the patch conversation, not sitting outside it. <\/p>\n\n\n\n
Because AI-assisted discovery finds vulnerabilities that would have taken human researchers years to uncover, vendors are disclosing and patching far more of them, far faster, than the traditional monthly cycle was designed to absorb. April 2026’s Patch Tuesday alone addressed 163 CVEs. Mozilla, using Mythos-class tooling ahead of a Firefox release, found 271 vulnerabilities in a single pre-release scan and has since shifted from monthly to roughly weekly security updates for some products. <\/p>\n\n\n\n
CVE submissions industry-wide grew 263% between 2020 and 2025, a volume increase so steep that the U.S. National Vulnerability Database shifted to a triage-only model in April 2026, meaning it can no longer enrich every submission with full analysis before publication. That puts more of the prioritisation burden back on individual organisations, at exactly the moment volume is climbing. <\/p>\n\n\n\n
Less than you think, and the gap is shrinking fast: Mandiant’s 2026 M-Trends research shows the average time between a vulnerability becoming public and attackers exploiting it has gone from 63 days in 2018, to 5 days in 2023, to attackers now exploiting vulnerabilities an average of 7 days before a patch is even released. AI-assisted exploit construction, of the kind demonstrated by Claude Mythos, is a major contributor to that trend. <\/p>\n\n\n\n
This single statistic is arguably the most important number in this entire shift, because it invalidates the assumption most patch management programmes are still built on: that there’s a reasonable buffer between “patch released” and “attacker weaponised.” In 2026, for a growing share of vulnerabilities, that buffer is gone or negative. <\/p>\n\n\n\n
Not on its own. Finding a vulnerability earlier is unambiguously good, but the security benefit only materialises once the fix is actually tested, approved and deployed across every affected system, and that step hasn’t gotten any faster just because discovery has. Every patch that lands still needs someone to determine exposure, test against dependencies, secure a maintenance window, and confirm the deployment didn’t break anything else. <\/p>\n\n\n\n
Most organisations already run close to capacity on their existing patch cadence: Ponemon Institute research puts unpatched vulnerabilities at the top of security leaders’ cyber risk concerns, with 54% of respondents actively grappling with the issue today, before AI-accelerated discovery adds materially more validated findings to the queue. Multiplying the number of validated, urgent findings entering that pipeline doesn’t add a bit more work. It changes the shape of the work entirely. The bottleneck has moved. It’s no longer “can we find the vulnerability.” It’s “do we have the operational capacity to act on everything we now know.” <\/p>\n\n\n\n
No, and several independent security bodies are now warning explicitly against that instinct. The Cloud Security Alliance has cautioned that undifferentiated speed, meaning trying to patch everything as fast as possible regardless of actual exploitability in your specific environment, creates its own risk, because it burns finite engineering capacity on lower-priority findings while genuinely critical ones queue up behind them. <\/p>\n\n\n\n
This is where frameworks like Gartner’s Continuous Threat Exposure Management (CTEM) come in: scoping, discovery, prioritisation, validation and mobilisation as an ongoing cycle rather than a monthly event. Around 75% of security leaders already have a CTEM programme in place or are actively building toward one, according to recent Gartner Peer Insights data, a strong signal that “patch smarter, not just faster” is becoming the dominant industry response. <\/p>\n\n\n\n
Rather than the old, binary question, are we patched?<\/em>, leadership conversations are shifting toward operational readiness: <\/p>\n\n\n\n These are resilience questions, not compliance questions. A “yes” to a checklist audit means far less than a demonstrated ability to move quickly when it actually matters. <\/p>\n\n\n\n In practice, most organisations are still trying to absorb this in-house, and the strain is already visible. A typical internal IT team is expected to track new patch releases across dozens of different vendors, work out which ones actually apply to their environment, assess the risk each one carries, and then schedule and execute deployment, all on top of the rest of their day job running the business’s technology. Recent industry research puts numbers on the pressure that creates: 98% of IT and security professionals say patching disrupts their work enough to force them to reallocate resources away from other priorities, 77% of organisations need more than a week to deploy a patch once it’s released, and 68% name patch management as their single biggest vulnerability management challenge. Nearly two-thirds say the handoff between finding a vulnerability and actually remediating it is where their process breaks down. <\/p>\n\n\n\n None of that accounts for the AI-accelerated volume increase already underway. With vendors like Anthropic, Microsoft and Mozilla now surfacing thousands of additional validated vulnerabilities a year, and CVE submissions industry-wide already up 263% since 2020, in-house teams that are struggling to keep up today are looking at a workload that is about to get meaningfully heavier, not lighter. Every extra day a validated, high-risk patch sits unassessed because the internal team hasn’t reached it yet is a day of exposure that didn’t need to exist. <\/p>\n\n\n\n Through a structured, continuously operating patch management function, either built internally at meaningful scale or delivered as a managed service, rather than by asking an already-stretched internal team to simply absorb more urgent work on top of existing priorities. Most internal IT teams are already juggling infrastructure modernisation, hybrid work support, cloud platform management, and a steadily growing volume of security alerts. Adding a sharp, sustained increase in validated, time-critical patches on top of that isn’t a minor resourcing adjustment. It’s a different operating model. <\/p>\n\n\n\n This is precisely the gap a mature managed patching service is designed to close: continuous monitoring of new security releases, risk-based prioritisation instead of blanket urgency, structured testing before deployment, consistent governance and reporting, and, critically, freeing internal teams to spend their time on the work that actually differentiates the business, rather than the recurring operational grind of keeping systems current. <\/p>\n\n\n\n Insentra’s managed patching services are built to take that entire burden off the client’s plate. We run a robust framework that continuously monitors and assesses vendor security patches across supported platforms, including Windows servers and endpoints, Citrix, IGEL, NetScaler and Intune-managed environments, so that instead of one internal team trying to track releases from dozens of vendors around their day job, a dedicated team is doing exactly that, all day, every day. That framework lets us rapidly identify which patches require immediate action based on their actual risk profile, rather than treating every release as equally urgent. Where a patch does require immediate action, we proactively notify the customer, then manage and execute the testing and deployment process end to end, governed by clear SLAs and reported with the visibility your board and auditors expect. <\/p>\n\n\n\n The value isn’t just that the patches get done. It’s that the assessment and execution sit with a dedicated team whose only job is to do this well, rather than with an already-overloaded internal IT function trying to fit it in around everything else they’re responsible for. That frees your internal team to spend their time on the parts of the role that genuinely require an understanding of your business, its priorities and its risk appetite, rather than the recurring grind of chasing vendor advisories across multiple platforms. The result is more value delivered internally, and less risk introduced by patching that is slow, inconsistent or incomplete. <\/p>\n\n\n\n As AI-driven vulnerability discovery becomes a permanent feature of the software landscape rather than a temporary spike, the organisations that come through it well won’t be the ones with the biggest security teams. They’ll be the ones with an operating model built to absorb the new pace of change, and a partner who already has. <\/p>\n\n\n\n Contact\u00a0Insentra<\/a>\u00a0about a managed patching assessment. Get a clear picture of your current patch posture, your exposure gaps, and what a fully managed model would look like for your\u00a0environment, before\u00a0the next wave of AI-discovered vulnerabilities lands on your desk.\u00a0<\/p>\n\n\n\n What is Claude Mythos? <\/strong><\/p>\n\n\n\n Claude Mythos is an Anthropic AI model, announced in preview form in April 2026, that can autonomously discover software vulnerabilities and construct working exploits for them at a level matching top human security researchers. It is not publicly available and is currently used only by select organisations through Anthropic’s Project Glasswing programme. <\/p>\n\n\n\n What is Project Glasswing? <\/strong><\/p>\n\n\n\n Project Glasswing is Anthropic’s controlled early-access initiative giving roughly 40 to 50 critical infrastructure and software companies, including Microsoft, AWS, Apple, Google and CrowdStrike, access to Claude Mythos to find and patch vulnerabilities in their own products before public disclosure. <\/p>\n\n\n\n What is Microsoft’s MDASH?<\/strong> <\/p>\n\n\n\n MDASH is Microsoft’s own AI-powered “agentic scanning harness,” built separately from Claude Mythos, using more than 100 specialised AI agents to scan, validate and help remediate vulnerabilities across Windows and other Microsoft codebases. <\/p>\n\n\n\n Is Claude Mythos the same as MDASH?<\/strong> <\/p>\n\n\n\n No. They are distinct systems built by different companies. Claude Mythos is Anthropic’s model, accessed by select partners through Project Glasswing. MDASH is Microsoft’s own internally developed system. Microsoft uses both. <\/p>\n\n\n\n Why are there more Windows and browser security updates than before? <\/strong><\/p>\n\n\n\n Because AI-assisted vulnerability discovery tools like Claude Mythos and MDASH are finding far more real, exploitable bugs, including issues that have existed undiscovered for years, than traditional human-led research could uncover at the same pace. Vendors are patching what they find. <\/p>\n\n\n\n How much time do businesses have to patch after a vulnerability is disclosed? <\/strong><\/p>\n\n\n\n Less than they used to. Industry research shows attackers are now exploiting some vulnerabilities an average of seven days before a patch is even released, down from a 63-day gap in 2018. Assume the buffer between disclosure and exploitation is short or already gone. <\/p>\n\n\n\n Does my business need to worry about this if we’re not a Project Glasswing partner? <\/strong><\/p>\n\n\n\n Yes. The vulnerabilities being found affect the operating systems, browsers and open-source software that virtually every business runs, regardless of whether the organisation itself is part of the discovery programme. <\/p>\n\n\n\n Should we just patch everything as fast as possible? <\/strong><\/p>\n\n\n\n Not indiscriminately. Security bodies including the Cloud Security Alliance recommend risk-based prioritisation, meaning patching genuinely exploitable, high-impact vulnerabilities first, rather than treating every finding as equally urgent, which can exhaust engineering capacity on lower-priority issues. <\/p>\n\n\n\n What’s the best way for a resource-constrained IT team to keep up? <\/strong><\/p>\n\n\n\n A structured, continuously operating patch management process, whether built in-house or delivered through a managed service, that handles monitoring, prioritisation, testing and deployment on an ongoing basis, rather than in periodic bursts. <\/p>\n\n\n\n How does Insentra’s managed patching service help with this? <\/strong><\/p>\n\n\n\n Insentra runs a dedicated team and framework that continuously monitors and risk-assesses vendor patches across servers, endpoints, Citrix, IGEL, NetScaler and Intune-managed environments, proactively notifies customers when a patch needs immediate action, and manages testing, deployment and reporting end to end under clear SLAs, so internal teams can focus on higher-value work instead of tracking advisories across multiple vendors. <\/p>\n","protected":false},"excerpt":{"rendered":" AI models can now find and weaponise software vulnerabilities in minutes to hours instead of weeks. Anthropic’s Claude Mythos, Microsoft’s MDASH, and the multi-vendor Project Glasswing initiative are already surfacing thousands of new CVEs across major operating systems, browsers, and open-source software. The result is more patches, released more often, with less time to react. That shift is turning… Continue reading AI Vulnerability Discovery Is Rewriting Patch Management\u00a0\u00a0<\/span><\/a><\/p>\n","protected":false},"author":63,"featured_media":40161,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[20],"tags":[],"class_list":["post-40160","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-workplace","entry"],"_links":{"self":[{"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/posts\/40160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/users\/63"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/comments?post=40160"}],"version-history":[{"count":2,"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/posts\/40160\/revisions"}],"predecessor-version":[{"id":40163,"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/posts\/40160\/revisions\/40163"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/media\/40161"}],"wp:attachment":[{"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/media?parent=40160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/categories?post=40160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insentragroup.com\/nz\/wp-json\/wp\/v2\/tags?post=40160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\n
\n
\n
\n
\n
How can organisations keep up without doubling headcount?<\/strong> <\/h2>\n\n\n\n
How Insentra helps organisations keep pace with AI-accelerated patch cycles<\/strong> <\/h2>\n\n\n\n
Frequently Asked Questions<\/strong> <\/h2>\n\n\n\n