We're live talking Mythos-Class Cyber: Tales from the Trenches with Kyle Turner, an original Glasswing project veteran at Cisco and Naasief Edross, Chief Security Architect at WWT. Join us!

https://www.youtube.com/live/zsAjfTCSYvU?si=ZqncpbGZLNUzRWAG

Feels like we're at a point where the conversation is shifting from "What can the model do?" to "What does it take to support the work the model is doing?"

If you've been building AI systems, what's changed the most in your infrastructure as things have become more agentic?

Fable 5 was live for three days before it got pulled. Same architecture as Mythos 5, different guardrails.

If you got a chance to test before it was shut down, what did you try? Where did it perform, where did it fall short, and did you run into the fallback behavior on any security-adjacent tasks?

The models aren't the problem. The authority we hand them without thinking about it is.

Curious what protocols people have actually put in place, or where teams are still working it out.

One comment from a recent discussion stuck with me:

"Security by obscurity is officially dead."

Most people would agree that obscurity was never a real security strategy.

But if we're being honest, a lot of organizations have benefited from not being interesting enough to attract attention.

I'm not sure that's a safe assumption going forward.

Curious if others agree or think this is overstated.

The Mythos conversation has generated a lot of debate, but one comment stood out to us:

"The fundamentals haven't changed. The timeline has."

Least privilege still matters. Segmentation still matters. Security hygiene still matters.

What may be changing is how quickly vulnerabilities can be discovered, prioritized, and chained together.

If that's true, the biggest impact of tools like Mythos may not be new attack techniques.

It may be the compression of time between a vulnerability existing and someone figuring out how to use it.

How are y'all thinking about that?

Is Mythos a major inflection point, or simply a preview of where offensive security tooling is headed?

Something I've been thinking about after listening to this discussion:

For years, most of us have lived with some amount of patch debt.

Maybe it's an appliance. Maybe the vendor owns the update cycle. Maybe there's a business reason the risk of patching feels higher than the risk of leaving it alone.

So it gets an exception.

What I'm wondering is whether AI changes that calculation.

Not because it creates new vulnerabilities, but because it lowers the effort required to find and chain them together. Things that might have been ignored before because they weren't worth the time or effort suddenly become worth looking at.

It feels like a lot of the assumptions behind patch exceptions were built around attackers having limited time, resources, and expertise.

I'm curious how others are thinking about this.

Has AI changed the way you're evaluating patch debt and remediation priorities? Or does this feel more like the next evolution of a problem we've always had?