Mythos at three months: measure exposure, not volume

The Hacker News published a piece today arguing that three months after Anthropic’s Mythos reveal, the industry has been having the wrong debate. Not the volume of new CVEs Mythos is generating. The exposure window — how long a vulnerability on your public-facing infrastructure sits unpatched. They’re right about which number matters. That number was also the right one to measure before Mythos existed.

I’m not writing this because The Hacker News cracked something open. I keep getting the same question from people running vulnerability-management programs: what do we actually do with the surge? Here’s what to actually do.

What changed since April

Mythos is Anthropic’s automated CVE-discovery system, revealed April 7. Since the reveal it has been submitting bugs at a pace nobody’s vuln program was sized for. Some are serious. Some are boring. All of them land in the same queue as the rest of the NVD daily deluge. That queue was already too big for a triage-by-volume approach. Mythos didn’t break your program; it made it obvious your queue was already the wrong tool for prioritizing work.

That’s the whole shape of it. Everything else is vendor rhetoric.

What to actually do

Ignore the queue. Instrument three things instead.

1. Time from KEV addition to patch deployed on internet-facing systems. This is your one number. CISA’s Known Exploited Vulnerabilities catalog is confirmed active exploitation — an attacker is using the bug, right now, in the wild. When something lands on KEV, your job is to close it fast on anything reachable from the internet. Measure that latency. If it’s over seven days on average, fix that before you buy any new tooling.

2. EPSS scores for anything not in KEV. FIRST’s Exploit Prediction Scoring System publishes a daily probability that a given CVE will be exploited in the next thirty days. On your internet-facing footprint: anything above 0.7 gets treated like it’s on KEV. Anything below 0.3 goes into normal patch cadence. The 0.3–0.7 middle band is where you use judgment. This is not new — FIRST has published EPSS for years. Mythos-era volume has just made using it non-optional.

3. What’s actually exposed. Not what’s in the CMDB. What’s answering on the internet right now, this week. If you don’t have a scanned inventory that refreshes at least weekly, that’s the spend that pays off. Not another AI SOC platform.

Priority call

• Patch KEV within seven days of add-to-catalog on anything internet-facing. Every time.
• Patch EPSS-above-0.7 within the same window on internet-facing.
• Everything else — including most of what Mythos is turning up — goes into your normal monthly cycle. Do not accelerate it.
• Do not buy a new vulnerability-management platform because someone told you Mythos changed the game. It exposed what was already true.

The Bad Epoll writeup from July 3 is a useful sanity check. Mythos caught the earlier bug in the same kernel code path (CVE-2026-43074). It missed Bad Epoll. The practical guidance for patching either was identical to what it would have been in 2019 — track your kernel versions, follow your distro’s security-update cadence, prioritize internet-facing hosts. AI-discovered or human-discovered, the patch cycle is the same.

Exposure window is what matters. It always was. The Mythos discourse hasn’t taught defenders anything new — it’s finally forced the honest admission that measuring queue depth was always the wrong number.