AI just crossed from cyber hype into cyber capability. The only defense that scales with it is the unglamorous work most teams keep deferring — Fundamentals.
By Piotr Kupisiewicz
This past November, Anthropic disclosed what it called the first reported AI-orchestrated cyber-espionage campaign, and it was alarming until you read the fine print.
The model, an earlier version of Claude, automated ordinary tooling and hallucinated credentials that did not exist; the researcher Kevin Beaumont put its real operational impact close to zero. Easy to file under hype.
Five months later, the same company published something that should close that file. In April 2026, Anthropic’s own red team described Claude Mythos, a model that, when directed, finds and writes working exploits for Zero Day vulnerabilities in “every major operating system and every major web browser.”
It surfaced a flaw that had been hidden in OpenBSD for 27 years, and on one browser engine it produced 181 working exploits where the prior frontier model managed two. Anthropic chose not to release it, warning that “in the short term, this could be attackers.”
That six-month jump is the real story. November was not the ceiling. It was the floor.
Defenders Alert
Consider what that means for anyone defending a plant, a hospital, or a substation. You cannot patch a vulnerability that has not been disclosed, and an AI that finds its own Zero Days does not wait for one. You also could never patch the base you actually run: Controllers, medical devices, and drives that are ten, twenty, thirty years old, unsupported, and often certified in a way that forbids touching them.
Mandiant now clocks the average time-to-exploit as negative, meaning attacks arrive before the fix exists. Against a model that writes the exploit, patch cadence is not a front line at all.
Here is the part of the report the headlines skipped. For all its range, Mythos kept failing against certain hardened targets: It could identify the flaw and still not complete the exploit, stopped by what Anthropic called defense-in-depth.
The most capable offensive AI yet built broke on fundamentals. That is the whole argument. The problem in critical infrastructure is not that the basics stopped working. It is that most environments never finished deploying them.
Fundamentals Work
The fundamentals are not a mystery, and every serious standard names the same short list.
See everything. You cannot protect, or segment, what you cannot find, and most operational networks still cannot produce an honest inventory of what they run.
Turn on multi-factor authentication for all remote and privileged access. It still blocks the overwhelming majority of account takeovers, and its absence runs through the breaches that actually hurt, from Colonial Pipeline to Change Healthcare.
Kill default and weak credentials. The Pennsylvania water utility that lost a booster station in 2023 was running the vendor’s factory default, “1111.”
Patch what you can, and contain what you cannot.
Segment so a single foothold is not a full takeover. This is the constant: However the attacker arrives, a stolen password today or an AI-written exploit tomorrow, segmentation decides whether one compromised device becomes the whole plant.
Exposed Sectors
The exposure is worst where technology cannot end up patched or taken offline: Manufacturing, the most-attacked industry five years running; healthcare, with its large base of legacy and unsupported medical devices; water, often run by a handful of people with no security budget; and the electric grid, fusing IT and operations while much of its distribution sits outside any mandatory cyber rule.
These sectors hold the most doors no patch will ever close, which is exactly where a model that writes exploits does the most harm.
There is a narrow piece of good news: This capability is not in attackers’ hands yet. Anthropic gave Mythos to defenders first, through a program it calls Glasswing, so a dozen of the largest technology and security firms can fix flaws before anyone else finds them.
But open-source models have historically trailed the frontier by nine to twelve months, so assume attackers reach it within a year. The organizations that come through that window will be the ones that did the boring work first. That is the real danger of the hype: it pulls money and attention toward AI pilots while asset inventory, multi-factor authentication, and segmentation stay unfunded.
We do not know exactly when this lands in the wild. We know what stops it, because the most advanced version of it has already been stopped. AI will write the exploits. The fundamentals decide whether that matters.
Close the gap while you still lead.
Piotr Kupisiewicz is Chief Technology Officer of Elisity. He works with critical-infrastructure operators across Europe and the United States.