Artificial intelligence is making it dramatically easier to find software vulnerabilities, but that does not mean organizations are becoming safer.
A new report from software supply chain security company Echo argues that the biggest bottleneck in cybersecurity is shifting away from vulnerability discovery and toward a more basic problem: deciding which findings matter and fixing them before attackers can take advantage.
Echo founders Eilon Elhadad and Eylam Milner
(Photo: Jenny Rochlin)
The company’s Mythos Readiness Report combines telemetry from Echo’s platform, a year-long study of nearly 40,000 CVE lifecycles across 250 widely used open-source container projects, survey responses from more than 80 U.S. security leaders and an independent analysis of Anthropic’s Claude Mythos model.
The report focuses on a central tension created by generative AI. Models are becoming increasingly capable of identifying weaknesses and developing exploits, but the volume and quality of their findings can make prioritization harder rather than easier.
On Anthropic’s own benchmark, exploit success against a known set of Firefox vulnerabilities increased roughly 90-fold between consecutive model generations. Anthropic has also shown that turning a known vulnerability into a working exploit can now cost less than $2,000 and take under a day.
But Echo’s analysis found that the picture is less straightforward when it comes to the quality of AI-generated findings.
Of 27 vulnerabilities Anthropic has publicly disclosed, Echo said only one of the eight findings initially rated “Critical” by Mythos held up under independent review. Fewer than 10% of the model’s 23,019 candidate findings have undergone external validation, according to the report.
“AI hasn't just made it faster to find a vulnerability; it's made it faster to be wrong about one,” said Eylam Milner, Echo’s CTO. “The industry has spent years optimizing for detection. This report shows that detection is no longer the constraint. It’s judgment, and it doesn't scale the way model inference does.”
Echo argues that the same imbalance is visible in broader vulnerability data.
The report says CVE counts have risen 145% in two years, while 89% of known vulnerabilities already have a fix available. Yet roughly 40% of fixable vulnerabilities remain unresolved for more than six months.
That matters because many attacks do not rely on brand-new, previously unknown flaws. According to Echo’s analysis, among vulnerabilities that eventually get exploited, roughly three in four are weaponized after the first day of public disclosure, often weeks, months or even years later.
In many cases, the fix already exists.
The company’s survey of security leaders points in the same direction. Thirty-seven percent said their biggest obstacle to improving software supply chain security was “detecting more than we can fix,” while only 11% said their next investment priority would be additional scanning or detection tools.
“The story everyone wants to tell about AI and security is about killer new exploits,” said Mor Weinberger, Echo Architect. “But the more interesting story is that most of what gets exploited was never a mystery in the first place. Organizations already knew about it, they just hadn't addressed it yet.”
Echo’s report introduces a four-stage readiness model intended to show how far an organization has moved from simply seeing vulnerabilities to actually reducing risk.
The stages are Exposed, Aware, Responsive and Proactive.
Echo says many organizations are currently stuck in the second stage, where visibility has improved faster than their ability to remediate what they find.
The broader argument is that AI is changing the economics of both offensive and defensive security. Vulnerability discovery is becoming cheaper and faster, but the ability to validate findings, prioritize them correctly and get fixes into production remains far less scalable.
For security teams already overwhelmed by alerts, that means the next competitive advantage may not come from finding more flaws.
It may come from knowing which ones matter, and fixing them before attackers do.