As large language models become increasingly capable of identifying software vulnerabilities, the cybersecurity industry faces a more fundamental challenge: turning automated discoveries into independently verified findings and effective remediation. Anthropic’s Claude Mythos illustrates both the potential and the risks of this technological shift. At DeepSec 2026 in Vienna, the debate extends beyond artificial intelligence to the practical security of physical access control systems.

Artificial intelligence is reshaping vulnerability research, promising to accelerate tasks that have traditionally required considerable technical expertise and manual investigation. Advanced large language models can examine extensive codebases, identify potentially vulnerable program structures and, under certain conditions, investigate how weaknesses might be exploited.
These capabilities represent a significant development in software security testing. Yet the growing sophistication of automated analysis raises an equally important question: Can organisations translate an expanding volume of machine-generated findings into measurable improvements in security?
The distinction matters. Discovering a potential vulnerability is not the same as demonstrating its exploitability, assessing its operational significance or ensuring that the underlying weakness has been eliminated. As AI systems become more productive, the effectiveness of vulnerability management may increasingly depend on what happens after a flaw has been identified.
The debate has gained momentum following developments at Anthropic, whose Claude Mythos model family has attracted attention for its cybersecurity capabilities. The company’s approach reflects the dual-use nature of advanced AI: technologies capable of assisting defenders in identifying weaknesses may also lower the barriers to offensive security operations.
In October 2026, Anthropic expanded its Cyber Verification Program, introducing differentiated access arrangements for qualified security professionals and organisations. The initiative reflects a growing recognition that increasingly powerful cyber capabilities require not only technical safeguards but also mechanisms governing their responsible deployment.

Thousands of Findings, but How Much Security Improvement?

Anthropic’s published vulnerability disclosure figures offer an indication of the scale at which AI-assisted security research is now operating.
According to the company’s disclosure dashboard, as of 2 October 2026, a total of 6,157 vulnerability findings had been reported to maintainers across 591 open-source projects. Of these, 516 were recorded as having been fixed.
The figures cover research conducted using several Claude models and should not be attributed exclusively to Mythos. Nor should reported findings automatically be equated with independently validated, exploitable vulnerabilities.
Nevertheless, the numbers illustrate a developing imbalance between the speed of vulnerability discovery and the capacity to investigate and resolve the resulting findings.
Further figures published in connection with Anthropic’s Project Glasswing suggest an even greater scale of activity. According to the company, participating organisations identified at least 129,000 verified software vulnerabilities between April and July 2026. Anthropic also reported approximately 5,500 additional verified findings from its own open-source investigations between April and October. More than 33,000 findings across these activities were classified as critical or high severity.
These aggregate figures are company-reported and cannot, on their own, establish the independent reproducibility, operational relevance or remediation status of every finding.
For security teams, the central issue is therefore not simply how many weaknesses an AI system can identify. What matters is whether those findings can be reproduced, prioritised and addressed within an effective vulnerability management process.
A vulnerability may be technically significant without being readily exploitable in a particular environment. Conversely, a weakness with a relatively modest severity assessment may pose a substantial risk when it affects an exposed system supporting critical business operations.
The ability to distinguish between these situations remains fundamental to effective cybersecurity.

Established Security Testing Methods Are Far from Obsolete

The enthusiasm surrounding AI-assisted vulnerability discovery can obscure an important historical reality: automated software testing has been part of security engineering for decades.
Static and dynamic analysis, manual code review, automated testing and fuzzing have long been used to identify defects and improve software reliability.
Fuzzing, in particular, demonstrates how established techniques have evolved through successive generations of computing technology.
The method involves exposing software to unexpected, malformed or systematically generated inputs in order to trigger abnormal behaviour and reveal potential weaknesses. Developed into a distinct field of computer science research during the 1980s, fuzzing has since become an important component of professional security testing.
Modern fuzzing systems extend far beyond random input generation. They use information about program execution, code coverage and previous test results to guide subsequent investigations.
Large language models can enhance these processes by interpreting program structures, proposing new test inputs, identifying potentially relevant execution paths or assisting with the analysis of complex failures.
Their contribution is therefore best understood as an extension of established security engineering practices rather than a wholesale replacement.
The real measure of progress is not whether AI can produce more suspected vulnerabilities, but whether it improves the precision, coverage and efficiency of the testing process.
An automated system that generates large volumes of poorly prioritised findings may ultimately increase the workload of security teams. Without reliable validation and remediation procedures, greater analytical capacity does not necessarily translate into stronger protection.

Local AI Models and the Protection of Sensitive Source Code

Another important development concerns the deployment of language models within controlled computing environments.
For organisations developing proprietary software or operating security-critical systems, the confidentiality of source code presents a significant consideration when evaluating AI-assisted testing tools.
Sending sensitive code to external services can introduce additional data protection, confidentiality and information security risks. Locally deployed models offer an alternative by allowing organisations to retain greater control over where code and analysis results are processed.
Such deployments are not inherently secure. They still require appropriate access controls, system hardening, model governance and protection of the supporting infrastructure.
Nevertheless, the ability to combine locally operated models with existing development and testing tools could make AI-assisted security analysis more accessible in environments where external processing is restricted.
Research into AI-supported analysis and repair of Linux kernel vulnerabilities illustrates the possibilities. Experimental systems have demonstrated that language models can contribute to identifying and correcting certain classes of software defects.
These research results should not, however, be confused with evidence that the official Linux kernel development process has universally adopted locally operated language models as part of its routine release testing.
The distinction between experimental capability and operational deployment is particularly important in security engineering, where reproducibility, reliability and the consequences of failure must be considered.
Language models can produce incorrect conclusions, overlook relevant vulnerabilities or propose changes that introduce additional defects. Their outputs therefore require technical verification and integration into established development, testing and release procedures.

Physical Access Control: Security Beyond the Software Layer

While AI-assisted vulnerability discovery has attracted considerable attention, the security of physical infrastructure presents equally demanding technical challenges.
DeepSec 2026 in Vienna will address both areas, extending its training programme to include a three-day course dedicated to physical access control systems.
Developed by the Red Team Alliance, the revised European edition of its Physical Access Control Systems (PACS) training programme combines foundational knowledge with practical examination of commercially deployed technologies.
The programme represents the first three-day training format introduced within the DeepSec framework and is based on the initial modules of the Red Team Alliance’s expanded five-day curriculum.
The first module, IDAC 101, addresses the architecture, deployment and operation of alarm and access control systems.
The second, PACS 201, examines commercially deployed platforms and the vulnerabilities commonly encountered in their implementation.
The third, PACS 213, focuses on European technologies, relevant certifications and technical standards.
Participants are also expected to work with the Proxmark5, a tool designed for investigating contactless identification and RFID technologies. Instructor-led demonstrations will examine its capabilities and limitations in comparison with existing analysis equipment.
The inclusion of physical access control systems reflects the increasingly interconnected nature of modern security architectures.
Electronic access systems are no longer isolated components responsible solely for opening doors. They frequently interact with identity management platforms, centralised authorisation services, building management systems and broader organisational IT environments.
Their security depends on more than the robustness of individual readers or credentials.
Authentication mechanisms, communication protocols, credential lifecycle management, system configuration and the administration of access rights all contribute to the effectiveness of the overall system.
A weakness in one component may compromise the integrity of the wider access control environment, potentially affecting facilities whose physical protection is essential to business continuity or critical infrastructure operations.
As with software vulnerabilities, identifying such weaknesses requires systematic testing, realistic threat scenarios and careful evaluation of operational consequences.

Cybersecurity Requires More Than Faster Discovery

The accelerating use of AI in vulnerability research has implications that extend beyond the technology itself.
For organisations responsible for complex digital infrastructure, the challenge is increasingly one of capacity and coordination.
Automated systems may identify weaknesses faster than development teams can investigate them, security departments can assess their relevance or software maintainers can deliver corrections.
This creates a risk that vulnerability discovery becomes disconnected from effective risk reduction.
A mature security programme must therefore integrate automated findings into a broader process encompassing asset visibility, risk assessment, remediation planning, patch management and verification.
The importance of these processes is reinforced by regulatory developments.
Within the European Union, the NIS2 Directive places greater emphasis on cybersecurity risk management, organisational accountability and appropriate technical and organisational safeguards. AI-assisted testing may support these obligations, but it does not transfer responsibility for security decisions from the organisation to the technology provider.
For operators of critical infrastructure, the relationship between cyber and physical security is particularly significant.
Digital vulnerabilities may affect the availability or integrity of systems supporting physical operations, while weaknesses in access control technologies may expose infrastructure to unauthorised intervention.
Effective resilience consequently depends on coordinated security management across technological and organisational boundaries.

DeepSec 2026: Putting Technological Claims to the Test

DeepSec has a longstanding focus on connecting practical security research with the critical examination of emerging technologies. Artificial intelligence has featured in its security discussions since 2018, reflecting the gradual evolution of machine learning from a specialist research subject into a major component of the cybersecurity landscape.
The 2026 programme brings together questions surrounding AI-assisted software testing, secure development practices and the technical assessment of physical access control systems.
The main conference will take place in Vienna on 19 and 20 November 2026. Regular training sessions are scheduled for 17 and 18 November, with the three-day PACS programme following an extended timetable. The closed DeepINTEL Security Intelligence Conference is scheduled for 18 November.
Conference presentations are planned as in-person sessions, with online access available to registered participants.
The broader significance of the event lies in the opportunity to examine emerging technologies beyond the claims surrounding their introduction.
Artificial intelligence may substantially expand the ability of security researchers to identify weaknesses in increasingly complex software environments. Yet the effectiveness of cybersecurity will continue to depend on established principles: evidence, reproducibility, professional judgement and the systematic elimination of identified risks.
The fundamental questions have not changed. What exactly is vulnerable? Under which conditions can the weakness be exploited? What are the consequences? And how can the underlying risk be reduced?
As automated vulnerability discovery becomes more powerful, the ability to answer those questions convincingly may become the most important measure of progress. [deepsec.net]