The Claude Mythos and the dispute between Anthropic and the U.S. government over Claude Fable 5 highlight a trend that CISOs and IT leaders should take seriously: AI will lead to more software vulnerabilities being discovered than ever before. The race against time to close them will be one of the greatest challenges—if not an overwhelming burden—for IT teams.
For patch management this means not only that the window between the discovery of a vulnerability and its potential exploitation is shrinking, but that the sheer volume is becoming increasingly unmanageable. Anyone who continues to roll out patches in long, rigid cycles will sooner or later fall victim to a cyberattack.
Key takeaways
- Claude Mythos demonstrates that AI can uncover significantly more software vulnerabilities—including those that have remained undetected for years.
- For IT teams, this increases not only time pressure but also the volume of patching: more findings, more updates, more packaging, and more documentation.
- Traditional patch management with rigid cycles reaches its limits when more patches must be evaluated and deployed in less time.
- Automation, third-party patching, and an up-to-date software inventory are becoming critical to keeping pace with this development.
1 What Claude Mythos means for patching and cybersecurity in general
Claude Mythos is being discussed primarily because modern AI models—so-called frontier models—no longer just recognize known patterns but can independently search for previously unknown vulnerabilities. Anthropic describes Mythos Preview as a model capable of finding and exploiting zero-day vulnerabilities in major operating systems and browsers. In some cases, this involved very old bugs, including a now-patched vulnerability in OpenBSD that, according to Anthropic, had remained undetected for 27 years.
Project Glasswing shows just how significant this shift could be. Anthropic reports that partners identified more than 10,000 high or critical vulnerabilities in critical software systems as part of the project. In open-source projects, Mythos Preview estimated an additional 23,019 findings, 6,202 of which were classified as high or critical.
The key here is less the language model itself and more the agentic way of working. Such systems can analyze code, form hypotheses, run tests, evaluate results, and adjust the next step. The Max Planck Institute describes this process as "plan, act, observe, correct."
How vendors are responding
Starting with the major software vendors, a trend reversal in patch cycles is becoming apparent. On May 28, Oracle ended a practice that had been in place since 2005: instead of its traditional quarterly Critical Patch Updates, the company is now delivering security updates monthly—a break from 21 years of established routine.
Adobe is following suit: starting July 14, there will be a second release date each month in addition to the regular patch day, with bulletins issued on the second and fourth Tuesday of each month.
Particularly noteworthy is the move by F5, which is also switching from a quarterly to a monthly model as of July 15. The announcement contains a phrasing that is striking: they intend to intentionally publish fewer details in release notes moving forward—so as not to provide attackers with a roadmap to the vulnerabilities being fixed.
"I wouldn't call AI a superweapon for cybersecurity operations, but rather an acceleration technology, an amplifier for existing capabilities."
Thorsten Holz, Max Planck Institute for Security and Privacy
This exponentially increases the challenge for IT and security teams. If AI makes significantly more vulnerabilities visible, the likelihood of cyberattacks will rise significantly for those who are unable to act. Being able to act means: monitoring for available patches, prioritizing, packaging, testing, troubleshooting, and rolling out in rings.
However, the Claude myth is not just a warning signal for the multiplication of patch and software packaging workloads. It is also a warning signal for increasingly shorter exploit times due to AI support for criminals. CVE-2026-48282, for example, was actively exploited within hours of its release, according to Adobe.
The standard approach—"we patch within 30 days, that’s enough for compliance and cyber insurance"—is now obsolete. When an exploit becomes available within hours, a 30-day window loses all protective effect, and even the frequently recommended 14 days are too long. This will place immense pressure on most IT departments.
2 Why current patch management processes no longer work
Many companies still think of patch management in terms of fixed cycles: monthly updates, defined maintenance windows, and individual special approvals for critical cases. This model is now falling apart.
This doesn't just apply to operating systems. It becomes particularly challenging with third-party applications and software components distributed across many endpoints, such as:
- Browsers
- PDF readers
- Office-related tools
- Collaboration clients
- VPN and remote access software
- Remote support tools
- Developer tools
- Runtime components
- Management agents
- Industry-specific applications
The more vulnerabilities discovered in these components, the greater the operational burden becomes.
This is precisely where software packaging and timely distribution, for example via Intune, SCCM or baramundi , become an underestimated security factor. When updates for third-party software are not available automatically, it creates extra work every single time: building the package, testing, distributing, checking for errors, and completing the rollout. With previous patch cycles, this was tedious. With the sharp rise in the volume of patches, it is becoming nearly unmanageable.
Our study, “State of Endpoint in DACH 2025/26,” shows just how large the gap in third-party patching already is today: 58% of the organizations surveyed currently use an automated patch catalog for third-party software, such as Patch My PC or Robopack. In our view, this is the only way to get a handle on patch management now, and together with our Software Packaging as a Service , it provides the complete solution for all applications.
3 Why the maximum patch window is shrinking at the same time
The patch window describes the time between the availability of a security update and its successful rollout on the affected systems. The longer this window remains open, the longer attackers can exploit a known vulnerability.
In the context of AI-accelerated attacks, this window is becoming increasingly critical. In the past, companies could afford longer assessment and rollout times for many vulnerabilities. Today, the pressure to identify, prioritize, and close critical vulnerabilities faster is mounting.
The situation becomes particularly critical immediately after a security update is released, as a patch often indirectly reveals which vulnerability has been addressed. Attackers can analyze the change to reverse-engineer the original flaw. With AI support, this patch reverse-engineering can happen even faster. This is precisely why the time between patch availability and a successful rollout has become a key security metric.
This does not mean that every patch should be installed immediately without testing. It does, however, mean that you must be able to distinguish:
The central metric here is Time-to-Patch: How long does it actually take you to get a relevant patch installed on the affected systems?
4 What modern patch management must now achieve
Modern patch management is not a single update or a recurring monthly process. It is one of the most important continuous tasks in IT security. It is an interplay of vigilance, consistency, prioritization, automation, and accountability.
Consistent, continuous, fast
Patch management is no longer a side task or something to be done once a month. Or even twice a month. It must be operated continuously and cannot be neglected, ensuring that every patch can be rolled out within a maximum of 14 days (though even that is no longer enough!). Automation plays a major role here, but it must not suggest a false sense of security for software that cannot be automated. It starts with simply being aware that a manufacturer has released a patch. This can only be achieved with dedicated resources or by outsourcing to a specialized service provider.
Holistic
The term "patch management" is often used to refer solely to patching Windows and Microsoft applications, a perception shaped by the famous Patch Tuesday. Furthermore, patch automation tools often only include widely used standard applications like Adobe Reader. This is far too limited. Patch management must encompass all operating systems, drivers, and applications used within the organization.
Automated
The aforementioned patch automation tools, such as Patch My PC, Robopack , or managed software from baramundi are essential! However, you must not neglect applications that are not in the catalog. Furthermore, the rollout requires human oversight and troubleshooting.
The fact that the average Patch My PC customer saves approximately 5,000 working hours per year alone shows that it is difficult to meet this challenge without third-party patch catalogs.
Risk-based prioritization
Not every vulnerability is equally urgent. CVSS scores are helpful, but they are not enough on their own. The decisive factor is whether a vulnerability is actually critical in your specific environment.
Important factors include:
- active exploitation,
- available exploits,
- internet exposure,
- number of affected systems,
- Permission context,
- Business criticality,
- existing compensating controls.
This prevents teams from wasting valuable time on less relevant updates while truly critical vulnerabilities remain open.
Tested and controlled
Faster patching doesn't mean patching without control. You need clear rollout rings and test groups. Ultimately, you need the certainty that a patch is actually being applied everywhere. In this phase, even automation requires human oversight. Critical updates must be accelerated without unnecessarily jeopardizing overall operations.
Transparent
Patches can only be rolled out reliably if it is clear which systems are affected. That is why you need an up-to-date overview of devices, operating systems, applications, versions, and exposure.
Without this transparency, a twofold problem arises: it is impossible to reliably track which systems are affected, and it is impossible to provide robust proof that a patch has been fully rolled out.
Here, too, tools like Patch My PC Advanced Insights and eido in combination with vulnerability scanners are worth their weight in gold.
What IT and security teams should check right now
Instead of reacting to individual AI models, you should test your patching process against AI-accelerated attack scenarios.
Focus on these key questions:
- How fast do you actually patch critical vulnerabilities?
- Which systems and applications are not fully inventoried?
- Which third-party applications are missing from your patching process?
- Are there specific SLAs for internet-facing systems?
- Are failed installations consistently followed up on?
- Are there clear responsibilities defined between IT, security, and business departments?
- Are exceptions documented and reviewed regularly?
- Is there reporting for management, audit, or cyber insurance?
5 Conclusion: Patch management is becoming a scaling issue
The Claude myth is not an isolated problem, but a symptom of a larger trend: AI is making more vulnerabilities visible, thereby increasing the pressure on vendors to provide security updates faster. At the same time, attackers can use the same technologies to analyze and exploit known gaps more quickly.
This creates a double burden for companies: more patches must be evaluated, packaged, deployed, and verified in less time. The answer is not panic, but a patch management strategy that is scalable, risk-based, and more highly automated.
The core fundamentals remain the same: a clean inventory, clear prioritization, reliable OS and 3rd-party patching, monitoring, and defined responsibilities. The key is that these fundamentals must now function faster, be more measurable, and require significantly less manual effort.
If your patch management needs to keep pace with increasing patch volumes and shorter response times, then Patch Management as a Service from SOFTTAILOR is the right next step. The combination of our software packaging with Patch My PC or Robopack, plus the dedication of a team focused exclusively on patch management, will let you sleep soundly at night.
Dorian has been involved in corporate and IT strategy since 2011. Due to the endpoint security deficiencies of many companies and the information overload, he developed the endpoint strategy. Dorian is co-founder of the “Endpoint Management” expert group at IAMCP e.V.
Years of Experience
Managed Endpoints
