Anthropic's Claude Mythos autonomously found thousands of critical vulnerabilities, including a 27-year-old bug in OpenBSD. The time between vulnerability disclosure and active exploit has collapsed from 20-30 days to under 30 minutes. Mythos-class AI doesn't need a zero-day. It finds your misconfigurations, your unenforced SSO, your over-privileged tokens, and chains them into an automated attack loop.
This playbook is the CISO framework for getting ahead of it. It structures the work around three questions every security leader needs to answer now: Can you discover, prioritize, and prevent malicious AI agents? Are your third-party apps and agents correctly configured? Is every app and agent properly vetted?
Inside, you'll find specific misconfigurations we've identified in real enterprise environments across Salesforce, M365, GitHub, and Snowflake, plus a vetting checklist for every app and agent in your perimeter and the before-during-after readiness framework for Mythos-class attacks.
%201.svg)
.svg)