AI and Cybersecurity: The Mythos Moment

Mythos represents a significant leap in AI-driven cybersecurity capabilities, particularly due to its ability to autonomously identify, analyse, and even exploit software vulnerabilities. Unlike earlier AI tools that required human-guided workflows, Mythos can perform multiple stages of vulnerability assessment independently. Project Glasswing, which restricts access to select firms building critical infrastructure, reflects a cautious approach to deploying such powerful technology.

The significance lies in the compression of the vulnerability lifecycle:

• Faster discovery of vulnerabilities
• Automated exploit development
• Potential for real-time threat analysis

This fundamentally alters the cybersecurity landscape by increasing both defensive and offensive capabilities.

From a policy perspective, the controlled release highlights concerns about misuse, especially in the context of zero-day vulnerabilities. Governments, including India’s, are studying its implications because such tools could disrupt national security frameworks. Thus, Mythos is not merely a technological advancement but a strategic inflection point in cyber warfare and digital governance.

The emergence of models like Mythos raises concerns primarily due to the dual-use nature of AI. While such tools can strengthen defenses, they can equally empower malicious actors. The ability to autonomously identify and exploit zero-day vulnerabilities means that attackers can scale their operations with unprecedented speed and efficiency.

Key concerns include:

• Democratisation of advanced cyberattack tools, enabling even non-experts
• Acceleration of the attack lifecycle, reducing response time for defenders
• Expansion of underground markets for zero-day exploits

These factors increase systemic risk, especially for critical infrastructure sectors.

Moreover, the real challenge lies in existing vulnerabilities. Many organisations struggle to patch known (N-day) vulnerabilities. If AI increases the volume of discovered flaws, it could overwhelm already strained systems. For instance, major ransomware attacks often exploit unpatched systems rather than sophisticated zero-days. Thus, while AI enhances capabilities, it also amplifies existing weaknesses, making cybersecurity more complex rather than inherently safer.

The integration of LLMs like Mythos is expected to fundamentally reshape the cybersecurity profession by automating repetitive and technical tasks while elevating the importance of strategic thinking. Tasks such as vulnerability discovery, reverse engineering, and exploit generation may increasingly be handled by AI systems.

This transformation will have several implications:

• Reduction in the need for deep technical specialisation in certain areas
• Increased emphasis on interpreting AI outputs and decision-making
• Shift towards roles focused on risk assessment, prioritisation, and system-wide defense

Professionals who can effectively integrate AI into their workflows will have a competitive advantage.

However, human expertise will remain indispensable. AI may identify vulnerabilities, but understanding their real-world impact—such as business consequences or exploit feasibility—requires contextual judgement. For example, bug bounty programmes may become more efficient, but the value will lie in analysing and prioritising findings rather than merely discovering them. Thus, the role evolves rather than diminishes, demanding adaptability and continuous learning.

Despite advancements in AI, vulnerability management remains a complex, multi-stage process that extends beyond mere discovery. While models like Mythos can significantly enhance the identification of vulnerabilities, they do not address deeper systemic challenges.

Key challenges include:

• Prioritisation: Determining which vulnerabilities pose the greatest risk based on context
• Validation: Confirming whether identified vulnerabilities are exploitable in real-world environments
• Patch management: Implementing fixes across large and diverse IT systems
• Resource constraints: Limited manpower and budget in many organisations

For instance, many high-profile cyberattacks exploit known vulnerabilities that were not patched in time, rather than newly discovered zero-days. This highlights that the bottleneck is often operational rather than technical.

Therefore, AI should be seen as an enabler rather than a solution. Effective cybersecurity requires a holistic approach, integrating AI tools with governance frameworks, skilled personnel, and robust incident response systems. Without addressing these structural issues, increased detection capabilities may paradoxically exacerbate the problem by creating an unmanageable volume of vulnerabilities.

Mythos-like AI models are likely to significantly alter the economics of zero-day vulnerabilities by increasing their supply and reducing their exclusivity. Traditionally, zero-days are valuable because they are rare and difficult to discover. However, AI-driven automation could make vulnerability discovery faster and cheaper.

This shift may lead to:

• A decline in the price of zero-day exploits due to increased availability
• Expansion of both legal (bug bounty) and illegal markets
• Greater participation from non-expert actors in cyber activities

This could disrupt existing business models of exploit brokers and cybercriminal networks.

However, the impact is not uniformly negative. As defenders also gain access to similar tools, the window of exploitation may shrink due to faster detection and patching. This creates a dynamic equilibrium where both attackers and defenders continuously adapt.

Critically, the real concern lies in asymmetry. Advanced state-sponsored actors may still maintain an edge by combining AI with intelligence capabilities. Meanwhile, less sophisticated actors may struggle to compete. Thus, while AI democratises access, it also intensifies the arms race, making cybersecurity a more volatile and competitive domain.

AI-driven tools like Mythos could significantly reshape state-sponsored cyber operations by enhancing both offensive and defensive capabilities. Governments that rely on zero-day exploits, such as those used in spyware like Pegasus, may experience both opportunities and challenges.

On the offensive side:

• Faster discovery and chaining of vulnerabilities
• Ability to target complex systems with minimal human intervention
• Increased scalability of cyber operations

For example, a state actor could use AI to identify vulnerabilities across multiple targets simultaneously, increasing operational efficiency.

On the defensive side, the same tools could reduce the shelf life of zero-day exploits by enabling quicker detection and patching. This undermines the exclusivity that state-sponsored actors depend on.

A practical illustration is the Pegasus spyware ecosystem, which relies on undisclosed vulnerabilities. If AI tools enable rapid identification of such vulnerabilities by defenders, the effectiveness of such spyware diminishes. However, sophisticated actors may adapt by focusing on misconfigurations or unpatched known vulnerabilities, which remain prevalent. Thus, AI introduces both disruption and adaptation in state-sponsored cyber strategies.

India and its IT sector must treat the emergence of tools like Mythos as a strategic wake-up call rather than a purely technological development. Given India’s large digital infrastructure and growing role in global IT services, the implications are both domestic and international.

Key lessons include:

• Strengthening vulnerability management: Focus on patching known vulnerabilities and improving response times
• Investing in AI-driven defenses: Leveraging similar technologies for threat detection and mitigation
• Policy and regulatory readiness: Developing frameworks for responsible AI deployment in cybersecurity

For example, India’s CERT-In and private cybersecurity firms could integrate AI tools to enhance threat intelligence and incident response. At the same time, public sector systems must address basic gaps such as outdated software and weak configurations.

Ultimately, the emphasis should shift from “finding vulnerabilities faster” to “protecting systems smarter.” This requires a combination of technological adoption, skilled workforce development, and robust governance. By doing so, India can not only mitigate risks but also position itself as a leader in the evolving global cybersecurity landscape.