Back in April I posted some early thoughts on the Mythos Report. I said I was cautiously optimistic and that we’d be able to confirm or disprove a lot of the claims in short order. Well… we have, mostly. The capability part held up. The part I don’t think anybody priced in is what happens after the bug is found.
Concern #1: Finding is cheap now. Fixing isn’t.
Last month Bank of America said it brought on 1,000 outside contractors in Q2 to help patch flaws exposed by advanced AI models, including Mythos. That’s according to Slashdot’s write-up of a CNBC interview with CEO Brian Moynihan. Those contractors are “on top of the 3,000 people we have in that area.” His words: “That risk is real risk… A lot of us sat down and said, ‘How do we figure out how to get through this quickly?'”
Most of the banks I work with don’t have 1,000 contractors on speed dial, or 3,000 people “in that area” to begin with.
Then we got PHP2Shell. Two critical, unauthenticated remote code execution bugs (CVE-2026-109618 and CVE-2026-109619) affecting PHP installs that serve web requests, which is a big chunk of the web. PHP shipped emergency patches on Oct 21. OpenAI says Calif found one of them with GPT-5.6 Sol, Wiz independently found both, and “to our knowledge, frontier AI found these vulnerabilities before attackers did.” Maybe… but Amazon says its MadPot honeypots caught an exploit attempt on Oct 17, four days before disclosure, and it’s unclear how the attacker got the details.
Amazon’s advice for critical internet-facing bugs: “measure patch and mitigation timelines in hours. A 7-day or 30-day SLA assumes a delay that no longer exists.” That’s a vendor blog, but I don’t think they’re wrong. And you can’t patch in hours if you don’t know where PHP is running… so the asset inventory comes first.
The finding side really did speed up
XBOW wrote up a full Chrome exploit chain built in six days, for roughly $40,000 in API charges. XBOW says a chain like that used to take “a team of four around 6-9 months” pre-LLM. In fairness, their researchers picked the targets and steered the agents, so this wasn’t push-button. Their own takeaway is worth repeating: “the bar is significantly lower. Defend accordingly.”
AWS reported its Security Agent exploited 33 of 37 recently disclosed CVEs end to end, with a median of about four hours each. Keep in mind this is AWS grading its own product. They call the benchmark “contamination-reduced, not contamination-free,” and in both misses the agent knocked the target offline. Hype is real in both directions.
Concern #2: “Is an AI pentest good enough?”
This is the question I expect from boards next. Two sponsored pieces on BleepingComputer give you both halves.
Intruder’s take is the optimistic one. Their agents found an auth bypass that had survived “five years of pentests,” and one customer fixed 78 issues in a few days. They’re also upfront that the agents “can’t ask you for anything you didn’t already give or tell them,” and they score risk higher than a human would.
Picus’s take is the gaps. They cite Omdia research saying organizations pentest only 32% of their attack surface on average. In one customer example, 480 instances were flagged for a single CVE. Only 120 could be tested, and the other 360 never got a verdict. They also claim attackers can weaponize a new CVE “within hours.” They don’t show much data for it, but PHP2Shell is one data point in their favor.
My answer: run it alongside a human pentest. Ask what it couldn’t reach, and whether you can actually fix what it finds.
Perhaps a better framing:
The question for your board isn’t “can AI find our vulnerabilities?” It can, faster than we can read the reports. The question is “how many can we fix per week, and which ones first?”
What I’d do:
- Track time to remediate. Finding counts are just the next vanity metric.
- When you buy an AI pentest, make the vendor tell you what it couldn’t reach, then triage from there.
- Plan for surge capacity (contracts, vendor SLAs), but also work toward patching continuously.
- And log and limit what tool-access agents can do.
