The AI Hacker Has Arrived. Here Is the Framework You Need.

Published by Wole Akpose · Author, Modern Cyber Risk Analytics and Management Using MATLAB & Python (Vols. 1–7) · cyberiskos.com

You woke up this week to news that the world has changed — again.

An AI model called Claude Mythos found a 27-year-old vulnerability in OpenBSD — an operating system built specifically around security — that had survived decades of human scrutiny. It found a 16-year-old flaw in FFmpeg that had outlasted more than five million automated tests. It identified zero-day vulnerabilities across every major operating system and every major browser currently in use. Then it autonomously generated working exploit code for 83.1% of them.

The response was immediate. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened an emergency meeting at Treasury headquarters with the CEOs of Citigroup (Jane Fraser), Morgan Stanley (Ted Pick), Bank of America (Brian Moynihan), Wells Fargo (Charlie Scharf), and Goldman Sachs (David Solomon) — along with JPMorgan’s chief information security officer representing a firm whose CEO was unable to attend — to warn them about the systemic cyber risk this represents to the entire financial system.

If you work in cybersecurity, this week felt like the ground shifting under your feet. If you run an enterprise, you are right to be alarmed. And if you have spent the last decade building a career around traditional security tools and processes — penetration testing, annual audits, qualitative risk heat maps — you are staring at a disruption you did not see coming.

The framework to navigate it already exists. This newsletter is where we build it together.

What Claude Mythos Actually Is — And Why It Changes Everything

Anthropic’s Claude Mythos Preview, released April 7, 2026, is not a more capable chatbot. It is a system that can autonomously identify software vulnerabilities, generate working exploits to weaponize them, and do so across every major operating system and browser simultaneously — without human guidance, largely overnight.

The benchmark performance is extraordinary by any standard. Mythos scored 93.9% on SWE-Bench Verified, the gold standard for real-world software engineering capability. It reached 97.6% on the 2026 USA Mathematical Olympiad, compared to 42.3% for its predecessor. On long-context reasoning, it jumped from 38.7% to 80.0%. Analysts have noted the performance delta is roughly 4.3 times larger than previous upgrade cycles between model generations.

The security capability is what set off alarm bells in Washington and on Wall Street. In one documented test, Mythos autonomously wrote a browser exploit chain combining four independent bugs to bypass both renderer and OS sandboxing — work that would previously have required a team of skilled security researchers over several weeks. It generated working exploit code in 83.1% of cases tested, up from 66.6% for the prior generation.

Anthropic has already committed over $100 million in usage credits to Project Glasswing — releasing the model in controlled form to 40 organizations including Amazon Web Services, Apple, Broadcom, Cisco, Google, Microsoft, NVIDIA, CrowdStrike, and JPMorgan Chase — so that defenders can begin securing critical systems before equivalent capabilities become broadly available to adversaries.

The market reaction told its own story. When news of the model first leaked in late March through an unsecured Anthropic data cache, cybersecurity stocks immediately repriced: CrowdStrike fell 7.5%, Palo Alto Networks dropped over 6%, Zscaler and Okta fell between 5% and 8%. Investors were not panicking because the world became less secure. They were reacting because an AI doing what Mythos does threatens to make the entire traditional cybersecurity vendor model obsolete — just as GPS made paper maps obsolete, not by making navigation harder, but by making the old approach irrelevant.

The emergency Wall Street meeting carries a different significance. When the Treasury Secretary and the Fed Chair personally convene the heads of the country’s most systemically important financial institutions over a single AI model, the message is unambiguous: this is no longer a technology risk. It is a systemic financial risk. The regulatory and market infrastructure for managing cyber risk at scale is now urgently, visibly overdue.

That infrastructure — the framework, the mathematics, the market design — is exactly what the Cyberiskos series was written to provide.

Why This Moment Was Always Coming — And What To Do About It

When I created EISSAF — the Enterprise Information Security and Safety Assurance Framework — the goal was straightforward: make actual security possible. Not security theater. Not glossy compliance reports. Not glorified qualitative hand-waving dressed up as risk management.

The goal was metrics. Verifiable assurance levels. Mathematics that could tell you, with precision, what your actual exposure is — and what it would cost to close it.

The traditional cybersecurity industry has resisted this kind of rigor for decades. Risk has been treated as a narrative, not a number. Insurance has been priced off questionnaires and gut feel. “Security posture” has meant whatever the vendor needed it to mean. The result is an industry that generates enormous revenue while leaving enterprises genuinely unable to answer the most basic question: How secure are we, really?

Mythos just made that question impossible to avoid.

But here is the detail getting the least attention in all the coverage, and it is the most important one. Anthropic’s own red team report states that over 99% of the vulnerabilities Mythos has found remain unpatched. The model found thousands of critical security flaws. Almost none of them have been fixed. The constraint was never detection. The constraint has always been capacity to act on what we already could not keep up with. A model that finds vulnerabilities ten times faster does not help if the humans on the other end are already overwhelmed.

This is precisely the gap EISSAF was designed to close — not just finding exposure, but quantifying it, prioritizing it, and building the assurance framework that tells an organization what to fix first, what to transfer through insurance, and what its genuine residual risk is.

The Three Forces Now Converging

The Cyberiskos series introduced three interlocking concepts that are more relevant today than when they were written. Here is how they map to the Mythos moment.

1. Claude Mythos — The Intelligence Layer

For the first time, a system exists that can continuously scan infrastructure, quantify vulnerability exposure at machine speed, and do so across every major platform simultaneously. This is not a point-in-time penetration test. It is continuous, scalable, machine-driven risk intelligence — and the exploit window, already compressed from months to hours in recent years, is now effectively eliminated for whoever holds this capability.

Anthropic’s Project Glasswing, with its $100 million in committed usage credits and its coalition of 40 critical infrastructure organizations, is the first serious attempt to deploy this capability defensively at scale. JPMorgan’s chief information security officer put it directly: the financial system is strongest when leading institutions work together on shared challenges, and Glasswing provides a unique early opportunity to evaluate next-generation defensive AI before adversaries develop equivalent tools.

This is the intelligence layer that Cyber Security Assurance requires to function at scale.

2. Cyber Security Assurance — The Product

Security-Assurance, as developed in the Cyberiskos series, is framed as a combination of two things: managed security with real quantification, and insurance to cover what cannot be secured.

The failure of traditional cyber insurance has always been the same: insurers cannot accurately price what they cannot measure. Annual questionnaires do not tell you the actual vulnerability surface of a bank running 1980s core systems under forty years of patches. Static audits cannot keep pace with an attack surface that changes daily.

Mythos changes this. With continuous AI-driven vulnerability intelligence feeding live security posture data, dynamic premium pricing becomes viable. The insurer finally has an actuarial foundation. The enterprise finally has a defensible number to put in front of its board. The managed security provider finally has a quantification engine precise enough to deliver on the assurance it promises.

The mathematics for this is developed across volumes I through V of the series, with production-ready MATLAB and Python implementations available to every reader.

3. Cyber Risk Exchange — The Market

The Cyberiskos series also introduced the concept of treating cyber risk as a tradeable commodity — a marketplace where cyber risk instruments can be standardized, priced, and exchanged, the way catastrophe bonds work for natural disaster risk.

For a liquid market to function, you need standardized risk pricing based on reliable, real-time data. That has always been the missing piece. Cyber risk has been too opaque, too poorly measured to securitize with confidence.

Mythos closes that gap. If AI can continuously audit every major system and quantify vulnerability exposure in near real-time, you finally have the data infrastructure to price cyber risk as a tradeable instrument. Volume VI of the series develops the full marketplace architecture and market design for the Cyber Risk Exchange — the instruments, the pricing models, and the clearing mechanisms.

The emergency Treasury and Fed meeting is, in effect, the regulatory recognition that this market infrastructure is now needed. Jamie Dimon said it plainly in his most recent shareholder letter: cybersecurity “remains one of our biggest risks,” and AI “will almost surely make this risk worse.” The question is who builds the market infrastructure first.

A Note on What This Does Not Solve

Intellectual honesty matters here, so it is worth naming what Mythos does not change.

Finding vulnerabilities was never the industry’s primary bottleneck. Fixing them was. With over 99% of Mythos-identified flaws still unpatched, the constraint is now even more visible: organizations need a rigorous framework for deciding what to remediate, what to insure, and what to accept as residual risk. That prioritization capability — grounded in mathematics rather than intuition — is the core of what EISSAF provides.

Mythos also does relatively little about social engineering, which remains one of the primary entry vectors for breaches regardless of how sophisticated vulnerability discovery becomes. And some serious analysts have raised legitimate questions about whether the public benchmarks Anthropic has released represent the model’s average performance or its best moments. These are fair points. The disruption is real; the marketing around it should be read critically.

What This Means For Your Career and Your Enterprise

If you are a cybersecurity professional, the disruption to traditional tools and roles is real. But the demand for people who understand quantitative risk — who can operate at the intersection of security, mathematics, and financial markets — is about to accelerate dramatically.

If you run an enterprise, the question is no longer whether you get breached. The question is whether you have the assurance framework in place when you do — and whether your security posture is genuinely measurable or just assumed.

If you are an insurer, a risk manager, or a financial regulator, the Mythos moment is your call to action. The tools to price, manage, and trade cyber risk at scale now exist. The mathematics is written. The code is ready to deploy.

About the Series

Modern Cyber Risk Analytics and Management Using MATLAB & Python is a 7-volume series covering the complete EISSAF framework — from foundational risk quantification through to Cyber Risk Exchange market design and AI-era threat readiness. Each of the 53 chapters is accompanied by production-ready MATLAB and Python implementations, available to buyers in a private GitHub repository, ready to fork and deploy.

→ Get all 7 volumes at cyberiskos.com

If this edition was useful, share it with a colleague in security, risk, or financial services.

Subscribe to Cyberiskos for the next edition.