The Mythos Era: Security Defenses Must Move Forward to Runtime
In security history, defenders once relied on a time gap—averaging two and a half years from vulnerability disclosure to weaponized exploitation, but by 2026 this has shrunk to hours, with the frontier model Mythos as the primary cause. This brings a dual challenge: unknown attacks (zero-day vulnerabilities with no CVE to look up) and a flood of known vulnerabilities (report overload causing prioritization chaos). Static code scanning cannot solve either problem; only runtime execution-based monitoring, which observes code and agent behavior in real time, can block unknown threats without relying on CVEs and filter out truly exploitable vulnerabilities, turning prioritization from guesswork into precision.
For most of the history of the security industry, defenders benefited from time. Vulnerabilities were disclosed, patches followed, and attackers needed months or even years to build reliable exploits. This time gap was the very foundation on which the entire 'scan-and-patch' model was based.
However, this buffer no longer exists. According to the 'Zero Day Clock,' the average time from vulnerability discovery to weaponized exploitation has plummeted from about two and a half years in 2018 to just hours in 2026, and frontier models like Mythos are the driving force behind this change. The same system that can find flaws in your code can also write a working exploit for that flaw, and both can be done at machine speed.
This simultaneously raises two problems pointing in opposite directions.
The first problem is 'unknown attacks.' Frontier models can discover zero-day vulnerabilities in your applications, AI agents, the tools they call, or their dependencies, with no CVE number or patch to reference. When the target is an agent holding API keys, database access, and the ability to execute code, the time from discovery to compromise shrinks to seconds. Since the vulnerability is never cataloged, scanning is out of the question.
The second problem is the 'flood of known vulnerabilities.' The same capabilities that discover new vulnerabilities also generate thousands of vulnerability reports. An already unmanageable backlog is now compounded. Teams patch based on intuition rather than risk priority, and every hour spent on vulnerabilities that can never be reached in production is time taken away from genuinely exploitable ones.
Note that neither of these problems can be solved by inspecting static code. Scanners cannot flag zero-day vulnerabilities that do not yet exist, nor can they determine whether a known CVE is truly reachable in your running system, so they flag everything and call it due diligence. The blind spot in both cases is the same: tools that inspect artifacts rather than behavior have no idea what your software actually does at runtime.
This is why, in the post-Mythos era, the only effective defense is execution-based monitoring. Instead of asking what problems the code might have, observe what the code and agents actually do at runtime, in real time—every prompt, every tool call, every API request, every library call, every resource accessed.
Observing execution solves the unknown problem without needing CVEs, while also mitigating the flood of known vulnerabilities. First, you can stop improper behavior just as you would stop a zero-day, buying time for remediation. Second, once you can see which functions actually run and are reachable, you can distinguish genuinely exploitable vulnerabilities in your environment from the thousands that exist only on paper. Unreachable CVEs once incurred significant management costs, but with this approach, their actual cost is zero; reachable ones get your attention. Prioritization is no longer guesswork.
In the past, 'prevention' meant keeping malicious things out before they could run. But in a world where attacks are generated on demand at speeds exceeding any human response, 'prevention' must mean identifying and stopping behavior as it occurs. The control point moves from the perimeter and pipeline to runtime.
The timeline will not move backward. The only defense that can keep pace with frontier models is one that exists where model exploits must ultimately run.