Mythos-class models went public in June. GPT-6 Astra and Gemini 4 Argon followed in September. Codex Security keeps scanning millions of commits. Your vulnerability vendors are racing to keep score. Here is what that does to your triage queue, and how D3 Security’s Morpheus AI turns their findings into finished remediation.
Executive Summary
AI discovery broke the patch cycle in 2026, and in June it went public. Anthropic shipped Claude Fable 5 on June 9, the first publicly available Mythos-class model, and restored global access on July 1 after a brief export-control pause. By May 2026, partners in the restricted Project Glasswing consortium had used the legacy Claude Mythos preview to find more than 10,000 vulnerabilities. OpenAI’s Codex Security scanned more than 30 million commits in its first months, and GPT-6 Astra, released September 3, is OpenAI’s first model rated Critical for cybersecurity. Google announced Gemini 4 Argon on September 30. Discovery runs at machine speed. In most SOCs, triage still runs at human speed.
That gap is the problem this paper is about, and the answer is a division of labor. Your vulnerability vendors (Tenable, Qualys, Rapid7, Wiz) discover, score, and recommend fixes. D3 Security’s Morpheus AI builds on that work. It ingests and references their findings during triage, correlates every finding by CVE and device, investigates attack paths across 800+ integrated tools, then takes the vendor’s own remediation steps and orchestrates them through those integrations, behind approval gates. Every finding gets comprehensive automated analysis.
Table of Contents
- AI Discovery Went Public in June: Anthropic, OpenAI and Google
- Why AI-Discovered Findings Break Manual Triage
- You Inherit the Flood Even If You Never Deploy Either Tool
- How Morpheus AI Triages Vulnerability Findings Today
- Your Vulnerability Vendors Do Discovery. Morpheus AI Finishes the Job.
- A Readiness Framework for the Multi-Model Era
- Questions for Your Evaluation
- Next Steps
- About D3 Security
- Sources
AI Discovery Went Public in June: Anthropic, OpenAI and Google
AI-scale vulnerability discovery is operational today and, as of June 2026, partially public. Three labs now run it, each with its own access model. None of them waits for your patch window.
Claude Fable 5 vs. Legacy Claude Mythos
Claude Fable 5, released June 9, 2026, is the first publicly available Mythos-class model. The distinction matters for planning: Fable 5 carries built-in safeguards that reroute cybersecurity requests to Claude Opus 4.8, so raw discovery capability stays out of public hands. Claude Fable 5.1 and Claude Mythos 5.1 followed on September 1, 2026, with Mythos 5.1 offered through Anthropic’s trusted access programs. The legacy Claude Mythos preview, the restricted model behind Project Glasswing, found thousands of previously unknown zero-days across every major operating system and browser. One had been sitting in OpenBSD for 27 years; another sweep surfaced 271 flaws buried in Firefox’s code for up to 20 years. Mozilla reported fixing those 271 Firefox vulnerabilities by May 2026.
- Project Glasswing, Anthropic’s vetted consortium, grew to roughly 200 organizations, including AWS, Apple, Google, JPMorgan Chase, Microsoft, and Nvidia, before Anthropic merged it into its Cyber Verification Program on October 6, 2026. Existing members moved to Specialized Access.
- By May 2026, Anthropic and its Glasswing partners had used Mythos to find more than 10,000 vulnerabilities in systemically important software.
- The timeline that matters: June 9, Fable 5 ships publicly. June 12, export-control pause after researchers surfaced a jailbreak. June 26, Mythos 5 cleared for vetted US critical-infrastructure defenders. July 1, Fable 5 restored globally with a new cybersecurity classifier Anthropic says blocks the bypass in over 99% of cases. September 1, Fable 5.1 and Mythos 5.1. October 6, Glasswing merges into the Cyber Verification Program.
- Net effect for SOC teams: public Fable 5 doesn’t add attacker discovery capability, but disclosure waves keep coming, and the vetted-defender pool that generates findings keeps growing.
The Latest From OpenAI: Codex Security, GPT-6 Astra, and Patch the Planet
Codex Security is OpenAI’s application-security agent. It finds a flaw, validates exploitability in a sandbox, and writes the patch. It launched as a research preview in March 2026. In testing before that launch, it scanned 1.2 million commits and surfaced 792 critical and 10,561 high-severity findings. Its audits of OpenSSH, GnuTLS, PHP, and Chromium produced 14 CVEs.
- By late June 2026, Codex Security had scanned more than 30 million commits across more than 30,000 repositories.
- Patch the Planet, OpenAI’s open-source initiative with Trail of Bits, is moving open-source projects from findings to fixes, including cURL, Go, Python, Sigstore, and pyca/cryptography.
- OpenAI released GPT-6 Astra on September 3, 2026, its first model rated Critical for cybersecurity under its Preparedness Framework. Through Daybreak, vetted defenders get GPT-5.6 Sol without system-level cyber guardrails (Daybreak Blue) or GPT-5.6-Cyber for exploit validation (Daybreak Red).
Google: Gemini 4 Argon
Google announced Gemini 4 Argon on September 30, 2026, and says it can “autonomously find, validate, and patch critical software vulnerabilities.” Google is offering Gemini 4 Argon to trusted defenders first through its Fairwind Program. Wiz researchers using Argon and GPT-5.6 Sol found PHP2Shell, two critical remote code execution flaws in the PHP runtime, disclosed on October 21, 2026.
Every new engine feeds the same downstream pipeline. Yours.
Why AI-Discovered Findings Break Manual Triage
An AI-discovered finding takes longer to triage than a traditional CVE advisory, and there are far more of them. The richness that makes these findings valuable also makes each one more work.
| Attribute | Traditional CVE advisory | Mythos triage report | Codex Security finding |
|---|---|---|---|
| Arrival pattern | Steady drip, human-paced | Disclosure waves, thousands at once | Continuous, per-commit |
| Detail level | Description, affected versions, CVSS score | Code-level analysis, ordered exploitation steps, verification agent results, human validation loop | Threat model, sandbox-validated exploitability, generated patch |
| Priority signal | CVSS only | AI-assessed severity with real-world exploitability | Severity plus validated exploit confirmation |
| Manual triage time (D3 estimate) | 15–30 minutes | 45–90 minutes | Patch review plus regression-risk assessment |
Run the math on one wave. D3 Security estimates a mid-size enterprise on standard Windows, macOS, and Chrome environments could catch 400 to 800 relevant AI-discovered findings at initial disclosure. Call it 600 analyst-hours. That’s an 8-person team doing nothing else for weeks, while 20 to 50 new findings land every week behind the wave. Analyst burnout already sits at 71% under today’s volumes. The senior people you need most for vulnerability triage are the first to quit when the backlog stops being clearable.
You Inherit the Flood Even If You Never Deploy Either Tool
Every organization inherits AI-discovered vulnerability volume through its supply chain, licensed or not.
- Dependency chains: a Codex Security finding in an open-source library becomes your exposure the moment the advisory publishes.
- Vendor patches: vendors fold AI-discovered flaws into their patch cycles. You see the CVE and the patch window, nothing else.
- Public advisories: GitHub Advisory Database, NVD, and Patch the Planet are accelerating advisory volume for software everyone runs.
- Researchers and red teams: published findings propagate fast, and exploit code is never far behind.
How Morpheus AI Triages Vulnerability Findings Today
Morpheus AI is D3 Security’s accountable agentic SOC platform, and it processes vulnerability reports through its attack-path investigation framework today. Vulnerability data moves through the same evidence-grounded, approval-gated architecture that handles security alerts.
- Ingest: prioritized vulnerability tasks arrive from your vulnerability and exposure-management platforms, including InsightVM, Qualys, Tenable, and Wiz, through Morpheus AI’s 800+ security tool integrations.
- Correlate: every finding is tied by CVE and device to the assets it actually affects.
- Investigate: attack paths are discovered from device vulnerabilities, including chainable exploit paths that CVSS scoring misses.
- Act: Adaptive Tasking investigates and remediates using that data, driven by LLM reasoning, AI SOPs, or an analyst’s prompt. Morpheus AI can ingest the vendor’s own recommended remediation steps and orchestrate them across patching, ITSM, and network tools through its integrations. Actions wait for explicit approval. Playbooks can call vulnerability integration commands at any step.
- Decide and verify: the analyst gets a prioritized, evidence-grounded verdict and approves the fix. Morpheus AI can then call the scanner back through the same integration to confirm the exposure is closed.
The economics are the point. Morpheus AI gives every finding comprehensive automated analysis and returns an evidence-grounded exposure verdict. When Morpheus is uncertain, it defers to a human. Headcount doesn’t scale that way. Automation does.
Why AI-Discovered Findings Fit This Architecture
AI-discovered findings reach Morpheus AI as prioritized vulnerability tasks from your exposure and vulnerability-management platforms, whether the underlying finding originated with a Mythos-class model, GPT-6 Astra, Gemini 4 Argon or Codex Security. When a task carries ordered exploitation steps, those steps become new nodes in Morpheus AI’s attack-path graph, which lets it correlate adversary activity it couldn’t see before. The steps cover a bounded slice of the attack surface; Morpheus AI maps the rest through network, identity, and telemetry data across the stack. Discovery models find it. Exposure platforms prioritize it. Morpheus AI resolves it across the stack. Morpheus AI ingests natively from Wiz, Tenable One, Qualys, and Rapid7, and the input format is model-agnostic.
Your Vulnerability Vendors Do Discovery. Morpheus AI Finishes the Job.
D3 Security works alongside vulnerability management platforms. Tenable, Qualys, Rapid7, and Wiz are good at finding exposures, scoring them, and recommending fixes. Morpheus AI consumes what they produce: it ingests and references their findings during triage, ingests their remediation steps, and orchestrates those steps through its integrations until the exposure is verified closed.
The division of labor is deliberate. A scanner can tell you a finding is critical and even hand you the fix. It can’t run your response: cross-tool investigation, business-context triage, change-window-aware orchestration, and closure verification when the work is done. That’s the job Morpheus AI does, across all four vendors at once, through one approval-gated workflow.
| Vendor | What their platform does | What Morpheus AI does with it |
|---|---|---|
| Tenable | Tenable One exposure management; ExposureAI generative analysis; VPR predictive prioritization | Ingests findings and priority context into CVE-and-device correlation and attack-path triage |
| Qualys | TruRisk scoring; TruLens threat context; Agent Val agent-led exploit validation and remediation recommendations | References validation verdicts as triage evidence; ingests recommended remediation steps and orchestrates them, approval-gated |
| Rapid7 | Exposure Command; Active Risk AI scoring; Remediation Hub with AI-generated remediation guidance | Ingests guidance and turns it into orchestrated remediation workflows across patching, ITSM, and network tools |
| Wiz | Code-to-cloud security graph; cloud exposure findings with remediation guidance | Ingests cloud findings into the same correlation and attack-path graph used for every other source |
A Readiness Framework for the Multi-Model Era
- Baseline your intake. Map every scanner and advisory feed you consume and measure findings per analyst-hour. You can’t size a gap you haven’t measured.
- Automate correlation before prioritization. CVE-and-device correlation turns a finding into an exposure fact. Do it by machine, for every finding.
- Write response policy as natural-language AI SOPs. Change windows, escalation paths, and regulatory triggers belong in written procedures the platform executes.
- Keep humans on decisions. Approval gates on remediation preserve accountability while the platform does the investigation work.
Questions for Your Evaluation
- Can your triage process investigate 100% of vulnerability findings, or does volume force sampling and priority queues?
- Does your platform correlate findings by CVE and device across your full stack, automatically, for every finding?
- Can it turn AI-generated exploitation detail into attack-path evidence your analysts can act on?
- What does one investigated finding cost you, and does that cost scale with volume or with headcount?
- Can analysts write response policy in natural language, without building a playbook for every novel zero-day?
- Are remediation actions gated by explicit human approval, with a full audit trail?
Next Steps
Book a 30-minute Morpheus AI demonstration focused on the vulnerability triage workflow at d3security.com.
Bring a 30-day export from your scanner. D3 Security will show how Morpheus AI would correlate, investigate, and prioritize your actual findings.
Pressure-test the readiness framework above against your current intake before the next disclosure wave lands.
About D3 Security
D3 Security builds Morpheus AI, the accountable agentic SOC platform that investigates every alert and vulnerability finding with evidence-grounded, approval-gated automation across 800+ integrated security tools. Learn more at https://d3security.com/.
Sources
- Anthropic: Project Glasswing, Securing critical software for the AI era (anthropic.com/glasswing)
- Anthropic: Claude Fable 5 and Claude Mythos 5 (anthropic.com/news/claude-fable-5-mythos-5); Redeploying Claude Fable 5 (anthropic.com/news/redeploying-fable-5); AWS News Blog, Claude Fable 5 on AWS
- MarkTechPost, July 1, 2026: Anthropic redeploys Claude Fable 5 after US export controls lift, adds new cybersecurity classifier
- 9to5Mac, June 2, 2026: Anthropic expands Glasswing as it promises public Claude Mythos-class model releases
- The Hacker News, March 2026: OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues
- OpenAI: Codex Security, now in research preview (openai.com)
- OpenAI, June 22, 2026: Daybreak expansion, Codex Security and Patch the Planet (openai.com/daybreak, openai.com/index/patch-the-planet)
- CSO Online, March 9, 2026: OpenAI says Codex Security found 11,000 high-impact bugs in a month
- Engadget, May 23, 2026: Anthropic says Mythos has already found more than 10,000 vulnerabilities (Project Glasswing update)
- Axios, August 10, 2026: OpenAI introduces a new cyber model amid fears of AI cyberattacks (Daybreak Blue and Daybreak Red)
- OpenAI, September 1, 2026: Path to Astra: critical capabilities and frontier safeguards (openai.com/index/path-to-astra)
- MacRumors, September 1, 2026: Anthropic launches Claude Fable 5.1 and Claude Mythos 5.1
- Axios, September 3, 2026: OpenAI releases new model GPT-6 Astra
- Google, September 30, 2026: Gemini 4 Argon: our next era of frontier intelligence (blog.google)
- Anthropic, October 6, 2026: Expanding the Cyber Verification Program (anthropic.com/news/cyber-verification-program)
- Fortune, October 21, 2026: AI helped discover the PHP vulnerability that could take down 70% of the internet (PHP2Shell)
- MindStudio / IEEE Spectrum / SpaceDaily coverage of Mythos-class findings, including the 27-year OpenBSD flaw and 271 Firefox vulnerabilities
- Vendor capability sources: Tenable One / ExposureAI (tenable.com); Qualys Agent Val and TruLens (qualys.com, StockTitan Jan 2026); Rapid7 Exposure Command and Remediation Hub press releases (rapid7.com); Wiz platform documentation (wiz.io)
- D3 Security: Morpheus AI product documentation (Rev. April 2026) and D3 internal estimates (triage-time, and burnout figures as published in D3’s April 2026 vulnerability triage whitepapers)
