Loading story…
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by October 31, 2026, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year "patch wall", overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses.
Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify 271 vulnerabilities fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed CVE to a working proof of concept to days or even hours, including for flaws such as CVE-2025-32433 in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted Project Glasswing program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's GLM-5.2 are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Also on 2026-07-07, the European Systemic Risk Board issued a formal warning about systemic cyber risks from frontier AI models. The European Supervisory Authorities backed the warning the same day.
On 2026-07-07, the European Central Bank sent a supervisory letter to the chief executives of about 110 significant institutions it directly supervises. The letter warned that AI-enabled cyber threats are accelerating ICT risk and ordered banks to submit action plans by 2026-10-31.
In early June 2026, Anthropic reportedly extended Project Glasswing access to around 150 additional organizations in more than 15 countries. The expansion included entities in energy, water, healthcare, communications, and hardware, subject to internal security requirements.
Anthropic introduced Claude Mythos Preview in April 2026 as a restricted-access cyber model rather than a broadly released product. The company kept access limited because it considered the model's advanced cyber capabilities to pose meaningful misuse risk.
Zhipu AI released the open-weight GLM-5.2 model on 2026-06-13. The model was described as competitive with Anthropic's restricted Claude Mythos on some cybersecurity tasks, particularly software vulnerability detection.
Mozilla said an early evaluation of Claude Mythos Preview identified 271 vulnerabilities that were fixed in Firefox 150. Mozilla argued this showed AI-assisted code reasoning can find bugs at a level comparable to elite human researchers.
Mozilla said an earlier effort using Anthropic's Opus 4.6 led to fixes for 22 security-sensitive bugs in Firefox 148. The company presented this as an early example of frontier AI helping identify latent browser vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
risky.biz
Open sourcezdnet.fr
Open sourcepostquantum.com
Open sourcecodeby.net
Open sourcecyberaccord.com
Open sourceresearch.hisolutions.com
Open sourceblog.mozilla.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security leaders are warning that **AI agents are increasingly operating as “digital employees”** inside enterprise workflows—triaging alerts, coordinating investigations, and moving work across security tools—often with **broad permissions and limited governance**. The core risk highlighted is that organizations are deploying high-authority agents like plug-ins (reused service accounts, overbroad roles, weak oversight), creating fast-acting operators that can be manipulated and that lack the contextual judgment and policy awareness expected of human staff. Related commentary also raises concerns about **AI-to-AI communication** and “non-human-readable” behaviors that could reduce auditability and complicate investigations and control enforcement. In parallel, public examples show how quickly AI can accelerate **vulnerability discovery**: Microsoft Azure CTO Mark Russinovich reported using *Claude Opus 4.6* to decompile decades-old Apple II 6502 machine code and identify multiple issues, underscoring that similar techniques could be applied to **embedded/legacy firmware at scale**. Anthropic has also cautioned that advanced models can find high-severity flaws even in heavily tested codebases, reinforcing the likelihood that both defenders and attackers will leverage AI for faster bug-finding. Separate enterprise IT coverage notes that organizations are **reallocating budgets toward AI** by consolidating tools and renegotiating contracts, which can indirectly increase security exposure if cost-cutting reduces overlapping controls or if AI adoption outpaces governance and identity/access management maturity.
Jun 29, 2026
Reports and commentary have intensified around claims that advanced AI systems can now discover software flaws and, in some cases, produce working exploits for them. A widely discussed account about Anthropic’s reported system, **Mythos**, said access had been limited to about 40 organizations in critical infrastructure so they could identify and remediate vulnerabilities before the capability spreads more broadly. Security contacts cited in the reporting said the tool was finding a notable number of high-quality bugs, while skeptics cautioned that some of the claims may be overstated. The debate has focused less on automated bug hunting alone than on the more consequential assertion that AI can bridge the gap from vulnerability discovery to exploit development, including alleged `zero-day` exploitation against major operating systems and browsers. Separate commentary described the development as a potential **“AlphaGo moment”** for vulnerability research, arguing that once such capability is demonstrated, containment becomes difficult because model replication, distillation, and parallel advances elsewhere could quickly erode any initial controls. The prospect has sharpened concerns for CISOs that defenders may face a dangerous period in which elite organizations gain access to powerful AI-assisted security tooling while critical infrastructure and legacy environments remain slow to patch, harden, or replace.
Jun 29, 2026
Security leaders are warning that **AI is accelerating zero-day discovery and exploit development**, compressing the time between vulnerability introduction, disclosure, and real-world abuse. A featured discussion of the **"Zero Day Clock"** argues that attackers benefit from a structural advantage because offensive validation is fast and binary, while defenders face slower, costlier verification and patching cycles; the result is a widening gap when organizations still operate on remediation timelines measured in weeks while active exploitation can begin in days. The reporting frames this as a material risk to enterprise resilience rather than a theoretical concern, especially as AI lowers the skill barrier for finding flaws in widely used software. One relevant reference also examines how **AI-enabled cyber operations** are becoming more autonomous, adaptive, and scalable, including target selection, phishing, and tactical decision-making without constant human direction. While focused on state espionage and policy implications rather than vulnerability research specifically, it supports the same broader development: AI is changing the speed and economics of offensive cyber activity. The remaining references are not about this event or topic; they cover detection strategy metrics, a personal newsletter essay, commercial spyware policy, software liability commentary, and a detection engineering newsletter, making them separate issues rather than part of the same story.
Jun 29, 2026