Mythos rolls out in weeks. Glasswing has found 10,000+ vulnerabilities. The UK employer response.

Three stories converged last week, and they tell one story about UK cybersecurity in 2026. First, Anthropic confirmed Mythos, its highest-capability model class, will roll out to all customers in “coming weeks” (Reuters, 28 May), exiting the small-circle Project Glasswing preview. Second, Cloudflare published a frank account of what happened when they pointed Mythos at live code across critical parts of their own infrastructure. Third, the BBC carried an interview with Valentina “Chompie” Palmiotti, the top performer at Pwn2Own Berlin and an IBM X-Force researcher, who said she competed this year because she thought it might be her last chance: Mythos and the unreleased GPT-5.5 Cyber are about to push elite human hackers out of routine bug-bounty work.

This is the cyber inflection. Frontier AI is now finding production-software vulnerabilities at a scale and speed that human red-teams cannot match, over 10,000 high- or critical-severity flaws surfaced through Glasswing in the weeks since the consortium went live. Anthropic CEO Dario Amodei has publicly described a six-to-twelve-month window in which Western organisations need to patch what Mythos has found before Chinese AI capability catches up and the same techniques get used offensively. For UK employers, this is not abstract. It changes what cybersecurity work looks like, who does it, and how it’s governed.

Project Glasswing was set up earlier this year to give a small set of partners early access to Mythos for cybersecurity work specifically. Cloudflare’s post describes the pattern. They pointed Mythos at live code across critical parts of their infrastructure. The model surfaced classes of vulnerability the existing tooling didn’t catch, at meaningful speed. It also got things wrong, false positives, confidently asserted fixes that were subtly incorrect. The honest version of the story is the model is materially better than what came before AND still requires human-in-the-loop verification.

That “materially better but still needs verification” is the operational shape of frontier AI in cybersecurity. It isn’t replacing skilled cyber people. It IS raising the floor under what skilled cyber people are expected to deliver. The job is shifting from “find the bug” to “govern what the AI found, prioritise it, verify it, patch it, and audit the entire workflow.”

Valentina “Chompie” Palmiotti was the most successful individual at Pwn2Own Berlin this year. She also told the BBC she expected this competition might be her last, because Mythos and the unreleased GPT-5.5 Cyber will likely push elite human researchers out of routine bug-bounty work. This matters for UK employers in two distinct ways.

First, the cyber labour market is bifurcating fast. Routine vulnerability discovery is moving to AI. Higher-order work, governance, prioritisation, response design, contextual judgement, regulatory interface, is becoming the human contribution. Second, this mirrors the same labour-market story we covered in our 1m NEET post and the HR department guide: AI compresses junior knowledge work and lifts senior knowledge work. The bridge across is structured, funded skills development. In cyber, that’s a particular combination of workshop-grade AI literacy plus formal governance training.

The honest read of the Cloudflare post + the 10,000 vulnerability figure + the Anthropic CEO’s 6–12-month window is that UK organisations of every size should be doing four things between now and Q4 2026. Not because their stack will get attacked tomorrow, but because the offensive parity Anthropic is warning about means Q1–Q2 2027 is when their stack might.

The four things are: run Mythos (or equivalent) against your own production code yourselves; build the governance frame for AI-assisted security work; train your team to verify, prioritise and patch what the AI surfaces; and document the entire workflow so it’s defensible to ICO/FCA/board oversight. Three of the four are training problems. UK funded training routes exist for all three.

Mythos doesn’t change the security job. It changes the standard the security team is held to. The team that has done the work, built the governance, and trained the people who can run AI alongside human verification is going to look very different in twelve months to the team that hasn’t. Rod Doyle, Director, TESS Group

How TESS Group fits

TESS isn’t a cyber-specialist provider. We are an AI & automation apprenticeship provider whose programmes happen to be exactly what UK organisations need to build the AI-and-governance side of the cyber response. The pairing we’re recommending most often this week is AU0010 (AI Adoption & Governance) at the senior level for the governance framework, ST1512 (AI & Automation Practitioner L4) at the practitioner level for the workflow and audit-trail build, and the Cyber Awareness workshop for baseline workforce capability. All three carry funded routes. And if you want to sample the leadership-and-governance curriculum before committing anything, the free AI Adoption & Governance taster day on 6 August is the zero-risk way in.

For organisations already on a journey, the AI Audit Trail framework we published earlier in May maps directly onto what a Mythos-era security operation needs to log per decision. The UK AI Compliance 2026 guide covers the regulatory interface (ICO, FCA Consumer Duty, EU AI Act scope, sector overlays). Read together, they form a practical playbook.

The wider context

This story sits next to two others we’ve covered this month. The Opus 4.8 launch showed how fast frontier capability is moving (~2-month cadence). The £725m apprenticeship reform package made the funded response materially cheaper. Mythos and Glasswing are why the response now needs to happen. The three together describe what 2026 actually looks like for UK employers: AI accelerating, funded skills routes expanding, security posture under pressure. The organisations that thread all three together, capability, training, governance, come out of 2026 in a different position to the ones that don’t.

Sources & further reading

Reuters: Anthropic to roll out Claude Mythos in coming weeks, launches Opus 4.8. Cloudflare: Project Glasswing, what Mythos showed us. BBC: Pwn2Own champion on Claude Mythos and her career. CNBC on Anthropic CEO’s 6–12-month warning. The Hacker News on the 10,000 vulnerabilities figure.