Mythos-class models went public in June. Codex Security keeps scanning millions of commits. Your vulnerability vendors are racing to keep score. Here is what that does to your triage queue, and how D3 Security’s Morpheus AI turns their findings into finished remediation.
Executive Summary
AI discovery broke the patch cycle in 2026, and in June it went public. Anthropic shipped Claude Fable 5 on June 9, the first publicly available Mythos-class model, and restored global access on July 1 after a brief export-control pause. The legacy Claude Mythos preview had already surfaced more than 10,000 high- and critical-severity vulnerabilities through the restricted Project Glasswing consortium, and over 99% of those findings are still unpatched. OpenAI’s Codex Security has scanned more than 30 million commits since March, and GPT-5.5 is now OpenAI’s most capable generally available model. Discovery runs at machine speed. In most SOCs, triage still runs at human speed.
That gap is the problem this paper is about, and the answer is a division of labor. Your vulnerability vendors (Tenable, Qualys, Rapid7, Wiz) discover, score, and recommend fixes. D3 Security’s Morpheus AI does not redo their work. It ingests and references their findings during triage, correlates every finding by CVE and device, investigates attack paths across 800+ integrated tools, then takes the vendor’s own remediation steps and orchestrates them through those integrations, behind approval gates. 100% of findings get comprehensive automated analysis in under two minutes each.
Table of Contents
- AI Discovery Went Public in June: Fable 5, Legacy Mythos, and the Latest From OpenAI
- Why AI-Discovered Findings Break Manual Triage
- You Inherit the Flood Even If You Never Deploy Either Tool
- How Morpheus AI Triages Vulnerability Findings Today
- Your Vulnerability Vendors Do Discovery. Morpheus AI Finishes the Job.
- What Ships Next: Vulnerability Management in the Morpheus AI v2 Release
- A Readiness Framework for the Multi-Model Era
- Questions for Your Evaluation
- Next Steps
- About D3 Security
- Sources
AI Discovery Went Public in June: Fable 5, Legacy Mythos, and the Latest From OpenAI
AI-scale vulnerability discovery is operational today and, as of June 2026, partially public. Two labs run it with two different access models. Neither waits for your patch window.
Claude Fable 5 vs. Legacy Claude Mythos
Claude Fable 5, released June 9, 2026, is the first publicly available Mythos-class model. The distinction matters for planning: Fable 5 carries built-in safeguards that reroute cybersecurity requests to Claude Opus 4.8, so raw discovery capability stays out of public hands. The legacy Claude Mythos preview, the restricted model behind Project Glasswing, found thousands of previously unknown zero-days across every major operating system and browser. One had been sitting in OpenBSD for 27 years; another sweep surfaced 271 flaws buried in Firefox’s code for up to 20 years. Over 99% of preview findings remain unpatched. The flaws aren’t obscure; the volume swamped coordinated disclosure.
- Project Glasswing, Anthropic’s vetted consortium, has grown to roughly 200 organizations, including AWS, Apple, Google, JPMorgan Chase, Microsoft, and Nvidia.
- Anthropic and about 50 partners have used Mythos to find more than 10,000 high- or critical-severity vulnerabilities in systemically important software.
- The timeline that matters: June 9, Fable 5 ships publicly. June 12, export-control pause after researchers surfaced a jailbreak. June 26, Mythos 5 cleared for vetted US critical-infrastructure defenders. July 1, Fable 5 restored globally with a new cybersecurity classifier Anthropic says blocks the bypass in over 99% of cases.
- Net effect for SOC teams: public Fable 5 doesn’t add attacker discovery capability, but Glasswing disclosure waves keep coming, and the vetted-defender pool that generates findings just got bigger.
The Latest From OpenAI: Codex Security, GPT-5.5, and Patch the Planet
Codex Security is OpenAI’s application-security agent. It finds a flaw, validates exploitability in a sandbox, and writes the patch. It launched as a research preview in March 2026; in the final 30 days of its beta it scanned 1.2 million commits and surfaced 792 critical and 10,561 high-severity findings. Its audits of OpenSSH, GnuTLS, PHP, and Chromium produced 14 CVEs.
- By June 22, 2026, Codex Security had scanned more than 30 million commits across 30,000+ codebases. Over 500,000 findings have been automatically verified as fixed; 70,000+ were confirmed by human reviewers.
- Patch the Planet, OpenAI’s open-source initiative with Trail of Bits, is moving 30+ projects from findings to fixes, including cURL, Go, Python, Sigstore, and pyca/cryptography.
- GPT-5.5 is now OpenAI’s most capable generally available model, and GPT-5.5-Cyber, its dedicated cyber variant, is in limited release to trusted defenders. GPT-5.6 Sol is in preview with select partners.
Every new engine feeds the same downstream pipeline. Yours.
Why AI-Discovered Findings Break Manual Triage
An AI-discovered finding takes longer to triage than a traditional CVE advisory, and there are far more of them. The richness that makes these findings valuable also makes each one more work.
| Attribute | Traditional CVE advisory | Mythos triage report | Codex Security finding |
|---|---|---|---|
| Arrival pattern | Steady drip, human-paced | Disclosure waves, thousands at once | Continuous, per-commit |
| Detail level | Description, affected versions, CVSS score | Code-level analysis, ordered exploitation steps, verification agent results, human validation loop | Threat model, sandbox-validated exploitability, generated patch |
| Priority signal | CVSS only | AI-assessed severity with real-world exploitability | Severity plus validated exploit confirmation |
| Manual triage time (D3 estimate) | 15–30 minutes | 45–90 minutes | Patch review plus regression-risk assessment |
Run the math on one wave. D3 Security estimates a mid-size enterprise on standard Windows, macOS, and Chrome environments could catch 400 to 800 relevant Mythos findings at initial disclosure. Call it 600 analyst-hours. That’s an 8-person team doing nothing else for weeks, while 20 to 50 new findings land every week behind the wave. Analyst burnout already sits at 71% under today’s volumes. The senior people you need most for vulnerability triage are the first to quit when the backlog stops being clearable.
You Inherit the Flood Even If You Never Deploy Either Tool
Every organization inherits AI-discovered vulnerability volume through its supply chain, licensed or not.
- Dependency chains: a Codex Security finding in an open-source library becomes your exposure the moment the advisory publishes.
- Vendor patches: vendors fold AI-discovered flaws into their patch cycles. You see the CVE and the patch window, nothing else.
- Public advisories: GitHub Advisory Database, NVD, and Patch the Planet are accelerating advisory volume for software everyone runs.
- Researchers and red teams: published findings propagate fast, and exploit code is never far behind.
How Morpheus AI Triages Vulnerability Findings Today
Morpheus AI is D3 Security’s Autonomous AI SOC platform, and it processes vulnerability reports through its attack-path investigation framework today. Not a roadmap item. Vulnerability data moves through the same evidence-grounded, approval-gated architecture that handles security alerts.
- Ingest: prioritized vulnerability tasks arrive from your vulnerability and exposure-management platforms, including InsightVM, Qualys, Tenable, and Wiz, through Morpheus AI’s 800+ security tool integrations.
- Correlate: every finding is tied by CVE and device to the assets it actually affects.
- Investigate: attack paths are discovered from device vulnerabilities, including chainable exploit paths that CVSS scoring misses.
- Act: Adaptive Tasking investigates and remediates using that data, driven by LLM reasoning, AI SOPs, or an analyst’s prompt. Morpheus AI can ingest the vendor’s own recommended remediation steps and orchestrate them across patching, ITSM, and network tools through its integrations. Actions wait for explicit approval. Playbooks can call vulnerability integration commands at any step.
- Decide and verify: the analyst gets a prioritized, evidence-grounded verdict and approves the fix. Morpheus AI can then call the scanner back through the same integration to confirm the exposure is closed.
The economics are the point. Morpheus AI analyzes 100% of findings with comprehensive automated analysis and returns an exposure verdict in under 2 minutes. Headcount doesn’t scale that way. Automation does.
Why Mythos-Class Findings Fit This Architecture
AI-discovered findings reach Morpheus AI as prioritized vulnerability tasks from your exposure and vulnerability-management platforms, whether the underlying finding originated with a Mythos-class model, Fable 5, or Codex Security. When a task carries ordered exploitation steps, those steps become new nodes in Morpheus AI’s attack-path graph, which lets it correlate adversary activity it couldn’t see before. The steps cover a bounded slice of the attack surface; Morpheus AI maps the rest through network, identity, and telemetry data across the stack. Discovery models find it. Exposure platforms prioritize it. Morpheus AI resolves it across the stack. Native ingestion from Wiz, Tenable One, Qualys, and Rapid7 is production-shipping today, and the input format is model-agnostic.
Your Vulnerability Vendors Do Discovery. Morpheus AI Finishes the Job.
D3 Security does not replace vulnerability management platforms, and Morpheus AI does not redo their work. Tenable, Qualys, Rapid7, and Wiz are good at finding exposures, scoring them, and recommending fixes. Morpheus AI consumes what they produce: it ingests and references their findings during triage, ingests their remediation steps, and orchestrates those steps through its integrations until the exposure is verified closed.
The division of labor is deliberate. A scanner can tell you a finding is critical and even hand you the fix. It can’t run your response: cross-tool investigation, business-context triage, change-window-aware orchestration, and closure verification when the work is done. That’s the job Morpheus AI does, across all four vendors at once, through one approval-gated workflow.
| Vendor | What their platform does | What Morpheus AI does with it |
|---|---|---|
| Tenable | Tenable One exposure management; ExposureAI generative analysis; VPR predictive prioritization | Ingests findings and priority context into CVE-and-device correlation and attack-path triage |
| Qualys | TruRisk scoring; TruLens threat context; Agent Val agent-led exploit validation and remediation recommendations | References validation verdicts as triage evidence; ingests recommended remediation steps and orchestrates them, approval-gated |
| Rapid7 | Exposure Command; Active Risk AI scoring; Remediation Hub with AI-generated remediation guidance | Ingests guidance and turns it into orchestrated remediation workflows across patching, ITSM, and network tools |
| Wiz | Code-to-cloud security graph; cloud exposure findings with remediation guidance | Ingests cloud findings into the same correlation and attack-path graph used for every other source |
What Ships Next: Vulnerability Management in the Morpheus AI v2 Release
The Morpheus AI v2 release makes vulnerability management a first-class investigation domain for attack-path analysis. It also adds a tenant-scoped self-learning pipeline that tunes confidence scoring, prioritization, and remediation recommendations from your analysts’ recorded outcomes. It learns from decisions. It never acts on its own. Both capabilities keep the platform’s standing guardrails: evidence-grounded output, tenant-scoped data, full audit trails, and human approval on actions.
A Readiness Framework for the Multi-Model Era
- Baseline your intake. Map every scanner and advisory feed you consume and measure findings per analyst-hour. You can’t size a gap you haven’t measured.
- Automate correlation before prioritization. CVE-and-device correlation turns a finding into an exposure fact. Do it by machine, for every finding.
- Write response policy as natural-language AI SOPs. Change windows, escalation paths, and regulatory triggers belong in written procedures the platform executes, not in tribal knowledge.
- Keep humans on decisions. Approval gates on remediation preserve accountability while the platform does the investigation work.
Questions for Your Evaluation
- Can your triage process investigate 100% of vulnerability findings, or does volume force sampling and priority queues?
- Does your platform correlate findings by CVE and device across your full stack, automatically, for every finding?
- Can it turn AI-generated exploitation detail into attack-path evidence your analysts can act on?
- What does one investigated finding cost you, and does that cost scale with volume or with headcount?
- Can analysts write response policy in natural language, without building a playbook for every novel zero-day?
- Are remediation actions gated by explicit human approval, with a full audit trail?
Next Steps
Book a 30-minute Morpheus AI demonstration focused on the vulnerability triage workflow at d3security.com.
Bring a 30-day export from your scanner. D3 Security will show how Morpheus AI would correlate, investigate, and prioritize your actual findings.
Pressure-test the readiness framework above against your current intake before the next disclosure wave lands.
About D3 Security
D3 Security builds Morpheus AI, the Autonomous AI SOC platform that investigates every alert and vulnerability finding with evidence-grounded, approval-gated automation across 800+ integrated security tools. Learn more at https://d3security.com/.
Sources
- Anthropic — Project Glasswing: Securing critical software for the AI era (anthropic.com/glasswing)
- Anthropic — Claude Fable 5 and Claude Mythos 5 (anthropic.com/news/claude-fable-5-mythos-5); Redeploying Claude Fable 5 (anthropic.com/news/redeploying-fable-5); AWS News Blog, Claude Fable 5 on AWS
- MarkTechPost, July 1, 2026 — Anthropic redeploys Claude Fable 5 after US export controls lift, adds new cybersecurity classifier
- 9to5Mac, June 2, 2026 — Anthropic expands Glasswing as it promises public Claude Mythos-class model releases
- The Hacker News, March 2026 — OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues
- OpenAI — Codex Security: now in research preview (openai.com)
- OpenAI, June 22, 2026 — Daybreak expansion: Codex Security, GPT-5.5-Cyber, Patch the Planet (openai.com/daybreak, openai.com/index/patch-the-planet)
- MindStudio / IEEE Spectrum / SpaceDaily coverage of Mythos-class findings, including the 27-year OpenBSD flaw and 271 Firefox vulnerabilities
- OpenAI — GPT-5.5 Instant release notes; Previewing GPT-5.6 Sol (openai.com)
- Vendor capability sources — Tenable One / ExposureAI (tenable.com); Qualys Agent Val and TruLens (qualys.com, StockTitan Jan 2026); Rapid7 Exposure Command and Remediation Hub press releases (rapid7.com); Wiz platform documentation (wiz.io)
- D3 Security — Morpheus AI product documentation (Rev. April 2026) and D3 internal estimates (triage-time, and burnout figures as published in D3’s April 2026 vulnerability triage whitepapers)
