Five days versus five years — Mythos, Apple's M5, and cyber's Manhattan moment.

3.1 The patch cycle as we know it is dead

Anthropic has disclosed thousands of zero-days. Fewer than 1% have been patched. The disclosure architecture — researcher finds bug, vendor patches, customers deploy over weeks-to-months — was built when humans found vulnerabilities one at a time. It cannot absorb the throughput of a model that turns known CVE + patch into a working exploit in under a day for under USD 2,000.

The time-to-exploit window is now smaller than the time-to-deploy window in almost every regulated industry I work with.

3.2 Architectural diversity is back on the table

Defence in depth still works, and architectural diversity matters. An exploit against one stack does not auto-port to another. Segmentation, identity controls, egress filtering and phishing-resistant MFA all raise the marginal cost for attackers, even at AI speed. Organisations that consolidated onto a single vendor stack for the sake of one pane of glass just learned a hard lesson.

3.3 Compensating controls are the new patching

When the patch backlog is structurally larger than your deploy capacity, the only honest answer is compensating controls applied at enforcement: WAF and network-layer signatures, endpoint policy, segmentation, ingress/egress filtering. Microsoft's MAPP programme worked this way for two decades. Anthropic will be pushed to build the same for Mythos disclosures.

3.4 Third-party and AI-vendor risk is now your kernel-bug risk

The Mythos side-door incident in April — a small group accessed Mythos via a third-party vendor environment using leaked internal URL patterns and unrevoked credentials — was the warning shot. The Apple M5 work is the live demo. A model with this capability sitting behind any vendor's credential lifecycle is a sovereign-risk problem, not a procurement problem.

3.5 Insurance, attestations, and disclosure regimes will move

Expect questions inside the next 90 days from:

• Cyber insurers, on whether your stack carries AI-enabled threat modelling.
• Auditors against ISO 27001 Annex A and ISO 42001, on whether AI-vendor risk is in your ISMS scope.
• APRA-regulated boards under CPS 230 and CPS 234, on whether "material service provider" definitions now include frontier model providers.
• ASD, on adoption of the Frontier AI board guidance.

Shift 1: From periodic patching to continuous exposure management

The vendors moving fastest (Palo Alto Networks, Rubrik, Zafran, the agentic-remediation cohort) have already pivoted to Continuous Threat Exposure Management (CTEM): live mapping of vulnerabilities to compensating controls, ranked by actual exposure path, with automated mitigation pushed through governed pipelines.

Shift 2: From products to architectures

• Memory-safe languages for new code. The economic case is now overwhelming. Rust, Swift, Go, modern C++ with hardening — anywhere you can.
• Hardware-assisted memory safety (MTE / MIE / CHERI) as a baseline expectation on new platforms, with the explicit understanding that MIE-class controls slow, not stop, model-paired attackers.
• Architectural diversity. Don't run one OS, one browser, one identity provider end-to-end through the crown jewels.

Shift 3: From human-speed response to agentic defence with governed autonomy

This is where most Australian boards are uncomfortable, and rightly so. Agentic remediation means a defender agent with the authority to push a WAF rule, revoke a credential, isolate a host, or roll a key without a human ticket. The honest answer is:

• The volume of model-discovered findings will exceed any human SOC's triage capacity inside 12 months.
• The only way to keep up is automation, and the only safe automation is policy-bounded, audited, and reversible.
• The governance work is the work. ISO 42001, the EU AI Act high-risk categories, NIST AI RMF, ASD Frontier AI — these are not compliance overhead, they are the operating manual.

Shift 4: From "the supplier list" to the five new risk surfaces

The Apple M5 incident lights up four of the five in a single story:

• Model provider risk — Anthropic itself.
• Third-party identity and credential lifecycle — Calif's Project Glasswing access route, the April side-door incident.
• Agent / inference endpoint risk — the model is the weapon and the workbench at the same time.
• Prompt-channel and telemetry risk — every red-team prompt is exfiltrable IP.
• Hardware-mitigation assumption risk — MIE was the marketed defence; it wasn't enough alone.

If your AI risk register has "vendor due diligence" as a single line item, it is not fit for purpose.

This week

• Pull your patching SLA dashboard. If you do not have one with time-to-deploy by criticality and environment, that is task one.
• Stand up a standing AI-vendor risk register. Frontier model providers and any vendor that uses one are now in scope.
• Re-read your CPS 230 material service provider list through the Mythos lens. Anything missing?

This quarter

• Run a Mythos-class tabletop: a Mythos-discovered zero-day drops on a library you use two hops down the dependency graph. Patch is a week away. Who decides what gets blocked at the edge in the meantime?
• Inventory compensating controls per asset class. Not products. Controls. Map them to MITRE ATT&CK and OWASP LLM Top 10.
• Get agentic remediation policy drafted, even if you don't deploy it yet. The hardest conversation is the policy one, and it cannot be done in an incident.

This year

• Move new code to memory-safe languages where feasible. Re-platform legacy hotspots on a budgeted runway.
• Adopt or align with ISO 42001 and the ASD Frontier AI guidance. Get the ISMS-modern lift done while the regulator is still in education mode.
• Build a defensive AI pilot: model-paired vulnerability scanning on your own codebase or that of your highest-risk supplier, with proper data governance.