When AI Finds Vulnerabilities Faster Than Enterprises Can Patch Their Applications
By Bob Kelly, Chief Product Officer at Juriba
AI-assisted vulnerability discovery is moving into defensive security programs. Anthropic’s Project Glasswing update said partners using Claude Mythos Preview collectively found more than 10,000 high- or critical-severity vulnerabilities after one month, while its open-source scanning work found 6,202 estimated high- or critical-severity findings across more than 1,000 projects.
OpenAI is moving in the same direction with Daybreak, a trusted-access program for approved defensive security work. Daybreak Blue gives access to GPT-5.6 Sol for vulnerability discovery, secure code review, incident response, and patch validation; Daybreak Red gives access to GPT-5.6-Cyber for more advanced, authorised security testing.
Anthropic described high- or critical-severity findings by partners, not 10,000 confirmed critical vulnerabilities already sitting in enterprise patch queues. Even still, it signals that bug discovery is getting faster, cheaper, and more automated, while fixing the issues still depends on people, vendors, process, and capacity.
What these models change
Claude Mythos Preview is an Anthropic model with advanced cybersecurity capabilities, provided through Project Glasswing to selected partners. These tools can inspect large codebases, reason across execution paths, generate tests, analyse crashes, and help researchers turn unusual behaviour into reproducible findings.
These new AI tools dramatically accelerate parts of the discovery and analysis process, in some cases reducing work that previously took hours to minutes. But human experts still need to validate findings, assess their severity and impact, coordinate disclosure, develop and test appropriate fixes, and ensure those fixes are safely deployed. That process can still take hours, days or considerably longer. Microsoft has already said AI is changing the scale and speed of vulnerability discovery, and that patching and exposure management practices built for a slower landscape may need to evolve.
Why the work lands with enterprise IT
When a weakness is found, enterprise teams still have to decide what it means in their environment. Exposure, asset value, business criticality, compensating controls, known exploitation, and the practicality of fixing the issue all change the response.
Finding more weaknesses sooner is good for defenders. It also creates more vendor fixes, more dependency updates, more installer changes, and more release decisions for enterprise teams.
Where today’s patching model falls short
Most enterprise patching processes were built around a manageable rhythm. Security teams review advisories, common software may be covered by patch catalogues, and everything else moves through tickets, application owners, packaging teams, pilots, and change processes.
That model struggles when more vendor releases carry security implications. Browsers, runtimes, endpoint agents, developer tools, middleware, plug-ins, and business applications all start to move through the same pressure pattern.
The work is rarely as simple as “apply the patch.” Teams still need to identify deployed versions, confirm ownership, source installers, understand dependencies, package or wrap the update, validate installation and removal behaviour, choose the deployment channel, manage exceptions, and support rollback.
Reducing exposure before every patch lands
Application patching remains the cleanest fix when a safe update exists. Exposure reduction gives teams more options when a patch is unavailable, risky, blocked by a vendor, or stuck behind operational constraints.
Start by removing what no one owns. Retire unused applications, unsupported versions, orphaned plug-ins, duplicate tools, and utilities that remain in the estate because nobody has had time to clean them up.
Constrain what cannot move quickly. Disable vulnerable features, reduce internet exposure, remove unnecessary privileges, tighten identity controls, segment systems that should not be broadly reachable, and improve detection around assets that remain exposed.
Patch catalogues help where they apply. Real estates also include niche tools, gated vendor downloads, legacy installers, regional applications, middleware, internal utilities, and inherited packages that still need a reliable update path.
Build before the surge
Start with inventory. Know what is installed, where it is installed, which versions are deployed, who owns each application, whether it is properly managed, and whether it has a repeatable update path.
Standardise the route from advisory to action. Every application needs a path from risk assessment to installer sourcing, packaging or wrapping, validation, publishing, monitoring, exception handling, and rollback.
Reserve specialist time for exceptions. Risk acceptance, sequencing, compatibility, business validation, and true exceptions need experienced people; repetitive packaging, wrapping, validation, and publishing work should be automated wherever possible.
AI-assisted vulnerability discovery will keep increasing the number of issues vendors find, validate, and fix. Teams that build discipline now will absorb the next surge without rebuilding the process around it. Teams that wait will keep treating every spike as a special project, even as the spikes become more frequent.
At Juriba, we help some of the world’s largest and most complex organisations operate their digital workplace with confidence in an era of continuous change.
