AI Vulnerability Triage: Frequently Asked Questions

AI vulnerability discovery models are frontier models that find and validate software vulnerabilities, offered to vetted defenders with safeguards lifted. Examples include Claude Mythos 5.1 through Anthropic’s Cyber Verification Program and GPT-5.6 Sol through OpenAI’s Daybreak Blue. Google is offering Gemini 4 Argon to trusted defenders first through its Fairwind Program. In its April 2026 preview through Project Glasswing, Claude Mythos Preview identified thousands of previously unknown zero-day vulnerabilities across every major operating system, browser, and enterprise application. Each finding can include code-level analysis, ordered exploitation steps, AI-assessed severity, automated verification agent results, and human expert validation.

Project Glasswing was Anthropic’s restricted access program for Mythos-class models, launched in April 2026 alongside Claude Mythos Preview. By May 2026, Project Glasswing partners had found more than 10,000 vulnerabilities, and Mozilla alone had fixed 271 in Firefox. On October 6, 2026, Anthropic merged Glasswing into an expanded Cyber Verification Program with three tiers: Defense Access, Red Team Access, and Specialized Access. Existing Glasswing members moved to Specialized Access.

Yes. Anthropic released Claude Fable 5, the first generally available Mythos-class model, on June 9, 2026. Claude Fable 5.1 followed on September 1, 2026, and Claude Mythos 5.1 is available to verified defenders through Anthropic’s Cyber Verification Program. Organizations that have not yet built autonomous triage capacity are already behind.

A mid-size enterprise running standard Windows, macOS, Chrome, and enterprise applications could face 400 to 800 relevant AI-discovered findings in a single disclosure wave. After the initial wave, expect 20 to 50 new findings per week on an ongoing basis. Within 12 to 24 months of the first public Mythos-class release (June 2026), additional AI vulnerability discovery models will compound the volume to an estimated 100 to 300 findings per week.

A standard CVE advisory takes 15 to 30 minutes to triage. An AI-discovered finding, with its code-level analysis, exploitation steps, verification results, and severity assessment, demands 45 to 90 minutes per finding. A single disclosure wave could require 400 to 800 analyst hours (10 to 20 full-time work weeks) for a mid-size enterprise to clear manually.

Triage reports from AI discovery models are far richer than standard CVE advisories. They include code-level analysis pinpointing the vulnerable function and execution context, ordered exploitation steps for tested applications, AI-assessed severity accounting for real-world exploitability, automated verification agent results confirming exploitability, and a human expert validation loop before disclosure. This richness makes each finding more actionable but also more time-consuming to process manually.

The 71% SOC analyst burnout rate exists under current alert volumes, before AI-discovered findings are added. Adding hundreds of hours of weekly vulnerability triage to already-overextended teams produces nonlinear fatigue. Experienced L2/L3 analysts, the staff most needed for AI vulnerability triage, are the first to leave because they have the most options and the least tolerance for unsustainable workloads.

AI vulnerability discovery is now a multi-model landscape. In testing before its March 2026 launch, OpenAI’s Codex Security scanned 1.2 million commits and surfaced 792 critical and 10,561 high-severity findings. OpenAI released GPT-6 Astra on September 3, 2026, its first model to reach the Critical cybersecurity threshold in its Preparedness Framework. Google announced Gemini 4 Argon on September 30, 2026, and is offering it to trusted defenders first through its Fairwind Program. In October 2026, PHP disclosed PHP2Shell, two critical remote code execution flaws in the PHP runtime that researchers found using GPT-5.6 Sol and Gemini 4 Argon. Each model produces findings in different formats with different severity models and verification standards. Any triage strategy that accounts only for Mythos is already outdated.

AI-discovered findings show that individually “medium” CVSS vulnerabilities can chain into critical exploit paths. A CVSS 5.3 information leak plus a CVSS 6.1 privilege escalation plus a CVSS 4.8 sandbox escape individually pass below thresholds, but together they form full remote code execution. Static CVSS filtering evaluates each finding in isolation and cannot detect this chainability.

AI vulnerability triage is the process of ingesting, analyzing, prioritizing, and remediating vulnerabilities discovered by AI models such as Anthropic’s Claude Mythos 5.1, OpenAI’s GPT-6 Astra and GPT-5.6 Sol, and Google’s Gemini 4 Argon. It requires autonomous processing due to the unprecedented volume and data richness of AI-discovered findings. No manual workflow can absorb the scale.

Morpheus AI processes vulnerability findings at machine speed using the same autonomous engine that triages alerts. It includes attack path discovery, contextual playbook generation, adaptive tasking, self-healing integrations, and bespoke processing tailored to each organization’s environment.

Morpheus AI ingests exploitation steps from AI-discovered findings into its attack path discovery framework, correlating them with vulnerability data across the environment by CVE and device. The exploitation steps from tested applications enable Morpheus AI to identify adversary activities and chainable attack paths that would otherwise go undetected.

No. AI discovery models and Morpheus AI are complementary. Discovery models find application-level exploitation paths for the specific applications they test, a critical but bounded portion of the overall attack surface. Morpheus AI maps the rest through its 800+ security tool integrations: network topology, user behavior, lateral movement indicators, and telemetry across the full stack. Discovery models find; Morpheus AI investigates, correlates, and remediates.

Yes. Morpheus AI’s customizable Cybersecurity Triage Reasoning Graph normalizes and processes vulnerability findings from any source: Claude Mythos 5.1, GPT-6 Astra, Gemini 4 Argon, Codex Security, future AI discovery models, traditional vulnerability scanners like InsightVM and Qualys, and manual submissions. The platform’s 800+ self-healing integrations ensure connectivity across the full security stack regardless of the finding source.

Self-healing integrations automatically detect and repair API drift when vendor tools update their interfaces. During mass remediation events driven by AI-discovered findings, widespread patching triggers vendor API updates that break traditional automation. Morpheus AI’s self-healing integrations detect drift and auto-repair connectors in 45 minutes to 2 hours, compared to 7 to 14 days for manual repair.

Contextual playbooks are response plans Morpheus AI generates at runtime from actual evidence. For AI-discovered zero-days, which are by definition previously unknown, static playbooks cannot incorporate the specific exploitation chain, environmental context, or chainability data that an AI-discovered finding provides. Contextual playbooks use four context layers: alert-specific data, cross-stack correlation, environmental factors, and SOC team preferences.

Phase 1 (Now): Audit your current triage throughput, map your exposure to AI-discovered findings across your software stack, and measure what percentage of analyst time goes to vulnerability triage today.

Phase 2 (Next): Deploy autonomous triage capacity, integrate vulnerability scanners for environmental context, and define response SOPs for AI-discovered findings in a format the autonomous system executes natively.

Phase 3 (Ongoing): Monitor autonomous triage accuracy against analyst spot-checks, measure time-to-remediation improvements, and iterate on SOPs as real AI-discovered findings reveal gaps.

AI vulnerability triage is the general process of analyzing and prioritizing AI-discovered findings. Any organization doing it manually or with automation is performing AI vulnerability triage. Morpheus AI performs it autonomously, with the same engine that triages alerts. It includes attack path discovery from exploitation steps, contextual playbook generation, adaptive tasking, self-healing integrations, and bespoke processing tailored to each organization’s environment.