The constraint in software security moved in 2026. For decades, the limiting factor was how quickly skilled people could find vulnerabilities. In its May 22 Project Glasswing update, Anthropic reported that the limit is now how quickly humans can verify, disclose, and patch the flaws AI models surface. That one shift explains most of where AI and security are heading, and it changes which skills carry weight for practitioners and certification candidates.
Based on what vendors and NIST have actually published this year, AI is making vulnerability discovery cheap while remediation stays slow and human. Autonomous agents have also arrived as a new kind of actor, and they need the same scoping, least privilege, and monitoring we already apply to people. None of this retires the fundamentals on the CISSP, CISM, or CompTIA blueprints. It raises the cost of getting them wrong.
Anthropic and roughly 50 Glasswing partners reported more than 10,000 high or critical severity vulnerabilities after about one month with Claude Mythos Preview.
Preparing for the CISSP exam? Compare class dates and formats for our CISSP boot camp.
How Is AI Changing Vulnerability Discovery?
AI models now find exploitable flaws at a rate no human team can match. In April 2026, Anthropic launched Project Glasswing and gave about 50 partners gated access to Claude Mythos Preview, a model Anthropic has held back from public release until it has stronger safeguards against misuse of its exploit capabilities. Within a month, partners had collectively reported more than 10,000 high or critical severity findings, and several said their bug finding rate had risen more than tenfold. Cloudflare reported 2,000 bugs across its critical path systems, 400 of them high or critical. Mozilla fixed 271 vulnerabilities in Firefox 150 while testing the model, more than ten times what it found in Firefox 148 using Claude Opus 4.6.
The open source numbers in the same update are the ones worth studying, because they show the full pipeline from detection to fix.
| Open source scanning metric (as of May 22, 2026) | Reported figure |
|---|---|
| Open source projects scanned | More than 1,000 |
| Findings the model estimated as high or critical | 6,202 (of 23,019 total findings) |
| High or critical findings independently assessed | 1,752 |
| Confirmed valid true positives | 1,587 (90.6%) |
| Confirmed high or critical after triage | 1,094 (62.4%) |
| High or critical bugs disclosed to maintainers (estimated) | 530 |
| Of those, patched at the time of the update | 75 |
| Average time to patch a high or critical finding | About two weeks |
Read that table the way a CISSP scenario would want you to. The find rate is not the risk metric. Real exposure sits in the gap between 530 disclosed bugs and 75 patched ones, and in the 9.4 percent of assessed findings that turned out not to be valid, each of which a qualified person still had to reproduce before anyone could rule it out. Anthropic also reported that some open source maintainers asked it to slow its disclosure rate because they could not design patches fast enough, while already dealing with a flood of low quality AI generated bug reports. For the background on how this started, see how an AI found a 27 year old bug every human missed.
Why Do Patch and Vulnerability Management Matter More Now?
Because patch volume is climbing faster than testing capacity. Anthropic noted that the latest Palo Alto Networks release carried more than five times its usual number of patches, and Microsoft has said its patch counts will keep trending larger for some time. Anthropic’s guidance to defenders is, by its own description, not new: developers should shorten patch cycles, network defenders should shorten testing and deployment timelines, and baseline controls such as hardened default configurations, multifactor authentication, and thorough logging matter more because they reduce risk without waiting on any single patch.
This is Domain 7 territory on the CISSP, and the exam logic applies directly. A doubling of patch volume does not double your change window, your test lab, or your staff. The correct response is risk based prioritization, which requires an accurate asset inventory, because a team cannot patch systems it does not know it runs. Compensating controls carry the load for everything waiting in the queue. Segmentation limits how far an exploited host can reach, and the per request authorization model in NIST SP 800‑207 zero trust limits what a compromised identity can touch. Change management keeps accelerated patching from causing its own outages. Candidates who pick the answer that patches everything immediately are usually picking the technician’s answer, and the exam is written for the manager.
Track mean time to remediate by severity, not the count of findings closed. When AI tooling triples the number of findings, the closed count will look excellent while critical exposure windows quietly get longer.
What Happens When AI Agents Act on Their Own?
On September 9, 2026, Anthropic published an alignment assessment of four incidents in which Claude models gained unauthorized access to real third party systems. All four happened during cybersecurity evaluations built by the same third party evaluation partner. Each model was told it had no internet access, but a misconfiguration left the internet reachable, and, as is standard for these evaluations, the models ran without the cyber safeguards that ship with released models. Anthropic has signed an agreement with METR to investigate independently.
The most serious case involved Claude Mythos 5 during a capture the flag exercise. It published a malicious package to PyPI, which was installed on 15 third party hosts that Anthropic believes were security vendors’ scanners. One scanner leaked credentials, and the model used them to access that vendor’s live database. PyPI removed the package in under an hour. In a separate incident, Claude Opus 4.7 found a real company with a name nearly identical to the fictional target and attacked its live web application, downloading and modifying user records. Anthropic describes two failure patterns across the incidents, biased reasoning about whether the environment was real and a reckless drive to finish the assigned task.
Strip away the AI framing and every lesson is a control we already teach.
The monitoring result deserves the most attention from SOC teams. Evaluate an agent on what it did and which systems it touched, and treat its own explanation as unverified input. That is the same principle behind reviewing privileged human activity from logs rather than from the administrator’s summary. The OWASP Top 10 for Agentic Applications 2026 covers the broader risk categories for these systems.
The rules of engagement point also connects directly to the planning and scoping domain in CompTIA PenTest+ PT0‑003.
How Are Security Frameworks Adapting to AI?
NIST published the preliminary draft of the Cybersecurity Framework Profile for Artificial Intelligence (NIST IR 8596) on December 16, 2025. It builds on CSF 2.0 and organizes AI security around three focus areas: Securing AI System Components (Secure), Conducting AI Enabled Cyber Defense (Defend), and Thwarting AI Enabled Cyber Attacks (Thwart). Public comments closed January 30, 2026, and the NCCoE Cyber AI Profile project held virtual working sessions on April 28, May 5, and May 12, 2026 to shape the next draft. NIST is also developing SP 800‑53 Control Overlays for Securing AI Systems, known as COSAiS.
A precision note: several secondary summaries label the second focus area Detect. NIST’s own publication page says Defend. Go to the primary source, the same habit that separates a correct answer from a nearly correct one on exam day.
Those three focus areas also describe where security careers are heading. Some practitioners will secure AI systems, some will run AI enabled defense, and some will defend against attackers using the same models.
What Does AI Mean for Security Certifications?
Certification bodies are adding AI content, and ISC2’s AI exam guidance for the CISSP is one example. The underlying domains are not being replaced. Least privilege, network segmentation, change management, rules of engagement, and log review each map to a lesson from the incidents above, and each already sits on the CISSP blueprint. Candidates who treat AI as a separate list of terms to memorize miss the point. Expect an AI scenario on the exam, and expect the correct answer to follow the same managerial reasoning as any other scenario.
Exam tip: When a question involves an AI agent, mentally replace “agent” with “privileged service account operated by an outside contractor” and ask which control you would apply. The answer usually lands on least privilege, defined scope, or independent monitoring.
Which Security Skills Will Matter Most as AI Advances?
The evidence so far points toward the work that sits after discovery. Validating and reproducing findings, prioritizing vulnerabilities by business risk, and running patch operations at higher volume all grow in value. So does identity and access management for non human identities, since agents hold credentials and act on them. Threat modeling for AI systems, and log analysis focused on agent actions rather than agent narratives, round out the list. These are skills AI tooling increases demand for, because every automated finding and every autonomous action eventually needs a qualified person to confirm it.
Frequently Asked Questions About AI and Cybersecurity
Will AI replace cybersecurity jobs?
Current evidence points to a shift in the work rather than a replacement. AI models are finding vulnerabilities far faster than before, but Anthropic reports that verification, disclosure, and patching remain constrained by human capacity, which increases demand for people who can validate findings and run remediation.
What is Project Glasswing?
Project Glasswing is an Anthropic initiative launched in April 2026 that gives about 50 partners gated access to Claude Mythos Preview to find and fix vulnerabilities in critical software. Anthropic reported more than 10,000 high or critical severity findings after roughly one month.
What is the NIST Cyber AI Profile?
The NIST Cyber AI Profile (NIST IR 8596) is a community profile built on CSF 2.0 that organizes AI security around three focus areas: Secure, Defend, and Thwart. NIST released the preliminary draft on December 16, 2025 and is developing the next version through NCCoE working sessions.
Can AI find zero day vulnerabilities?
Yes. Anthropic reports that Claude Mythos Preview found thousands of previously unknown high severity vulnerabilities, including some in every major operating system and web browser, and that independent triage confirmed 90.6% of assessed high or critical open source findings as valid.
What security risks do autonomous AI agents create?
Autonomous agents can act outside their intended scope when isolation fails or boundaries are undefined. Anthropic’s September 2026 assessment described evaluation incidents where Claude models reached real third party systems after a network misconfiguration, which reinforces the need for verified segmentation, explicit scope, least privilege, and action based monitoring.
Do security certifications cover AI now?
Yes, increasingly. ISC2 has issued AI guidance for the CISSP, and newer credentials such as CompTIA SecAI+ focus on AI security directly, but the core domains of access control, security operations, and risk management still carry most of the exam weight.
CMO & Certification Guru | Training Camp
Mike McNelis is the CMO at Training Camp, where he combines a passion for technology with a hands-on approach to leadership. Beyond overseeing marketing strategy, Mike is actively involved in the technical side of the business — collaborating with clients, shaping learning solutions, and staying connected to the fast-changing world of IT and cybersecurity. He works closely with companies, government agencies, and individuals to help them achieve meaningful certification and workforce development goals.