In recent weeks, defenders have been forced to rethink threat timelines after Anthropic released a startling claim: its Mythos Preview model can generate functional N‑day exploits in a matter of minutes, and for a fraction of the cost previously associated with manual development. For security engineers, red‑team leads, and developers who build protective tooling, this shift isn’t just a curiosity—it reshapes how we prioritize patching, threat‑intel workflows, and even budgeting for defensive research.

---

What is an N‑day exploit?

An N‑day (or known‑vulnerability) exploit targets a flaw that has already been disclosed and patched, but for which many systems remain unpatched. Unlike a zero‑day, which is unknown to vendors, an N‑day is publicly documented, yet attackers can still leverage it until the vulnerable software is updated across the ecosystem. Historically, crafting a reliable N‑day exploit required weeks of reverse engineering, deep knowledge of the vulnerable code path, and often bespoke shellcode.

Anthropic’s Mythos Preview: Claims and Evidence

On June 8, 2026, Anthropic’s internal Red Team published a report describing how Mythos Preview—a frontier‑scale language model—generated functional exploits against 21 previously published bugs, 18 of which were successfully weaponized. The fastest exploit was produced in 31 minutes, and the entire operation cost under $2,000 in token usage. Notably, Microsoft had previously classified 14 of those vulnerabilities as “less likely” or “unlikely” to be exploited, suggesting that traditional risk scoring may be under‑estimating actual adversary capability when LLMs are in play.

How the test was conducted

1. Selection of targets – The team chose a mix of high‑profile bugs from Microsoft’s public advisories and other well‑known CVEs.
2. Prompt engineering – Researchers supplied Mythos with concise problem statements, such as “Generate a remote code execution payload for CVE‑2024‑XXXXX on Windows 11.”
3. Iterative refinement – The model’s output was executed in a sandbox, errors were fed back, and the prompt was refined until a working exploit emerged.
4. Cost accounting – Token consumption was logged, translating to a monetary cost of roughly $2,000 for the entire suite of 18 exploits.

Why the speed matters for defenders

The conventional defensive timeline assumes a window of weeks between vulnerability disclosure and exploit availability. This gap allows organizations to prioritize patch rollouts, issue mitigations, and monitor for associated Indicators of Compromise (IOCs). If an LLM can collapse that window to hours, the “grace period” disappears, and the risk calculus changes dramatically:

• Patch prioritization must accelerate – Security teams need automated patch‑testing pipelines that can apply updates within hours rather than days.
• Threat‑intel feeds need real‑time enrichment – Traditional feeds that publish CVE details may become insufficient; they must also include AI‑generated proof‑of‑concepts to warn of imminent weaponization.
• Budget allocations shift – Investing a few thousand dollars in LLM‑driven exploit research may now be comparable to hiring a senior red‑team consultant for a week.

Practical steps for development teams

1. Harden CI/CD pipelines against AI‑generated payloads

Add a static analysis stage that scans newly built binaries for known shellcode signatures and for anomalous patterns that often appear in AI‑crafted payloads (e.g., overly generic function calls, repetitive byte sequences). Tools like Trivy or Syft can be extended with custom rule sets to flag such artifacts.

2. Implement “fast‑track” patch testing

Leverage container orchestration to spin up test environments the moment a CVE is announced. Run the vulnerable component against the MI‑generated PoC automatically; if the PoC succeeds, flag the patch as critical and push it through an expedited release lane.

3. Deploy LLM‑assisted defensive scripting

Just as attackers can use LLMs to create exploits, defenders can harness the same models to auto‑generate detection signatures. Feed the model the exploit code and ask for YARA rules, Sigma queries, or eBPF monitors that would catch its behavior. This turns the adversary’s advantage into a defensive asset.

4. Monitor token‑level activity on public LLM endpoints

Many cloud AI providers expose usage dashboards. Set alerts for spikes in token consumption that correlate with known‑vulnerability keywords (e.g., “CVE‑2024‑XXXXX exploit”). While this won’t catch all malicious activity, it can provide an early warning that a model is being abused for exploit generation.

Broader implications for the security ecosystem

Redefining “exploit‑ready”

The line between research and weaponization is blurring. Historically, an exploit reached “ready” status after extensive manual polishing. With LLMs, the polishing step can be automated, meaning the barrier to weaponization is lower than ever.

Ethical considerations for AI providers

If a model can output working exploit code, providers face pressure to implement usage controls similar to those used for disallowed content (e.g., hate speech). This could manifest as:

• Real‑time content filtering that detects exploit‑related prompts.
• Tiered access where higher‑risk capabilities are gated behind stricter vetting.
• Auditable logs that allow law‑enforcement to trace abusive usage.

Potential for an arms race

As defensive teams adopt AI‑driven detection, attackers will likely fine‑tune their prompts to evade those same detectors. The equilibrium may settle into a continuous cat‑and‑mouse game where both sides iterate on prompting techniques, model fine‑tuning, and post‑processing filters.

Key takeaways

• Mythos Preview can produce functional N‑day exploits in minutes for under $2,000 in tokens.
• Traditional risk scoring may under‑estimate the likelihood of exploitation when AI is involved.
• Defensive workflows must accelerate patch testing, incorporate AI‑assisted detection, and monitor LLM usage patterns.
• Security teams should treat LLMs as both a threat vector and a tool for rapid signature generation.
• The industry must grapple with ethical and policy challenges around AI‑generated malicious code.

---

Conclusion

The Anthropic report is a wake‑up call: frontier language models are no longer experimental curiosities but practical exploit generators that can compress weeks of work into hours. For developers and security professionals, the imperative is clear—embrace AI‑driven defenses, shorten the time from vulnerability disclosure to remediation, and stay ahead of the evolving threat landscape. The next few months will likely see a surge in tooling that leverages the same models attackers use, turning the tide back in favor of defenders.

---

Source: Anthropic warns LLMs can crank out N‑day exploits cheap and fast