Mythos changes everything: Is your AI agent security ready?

Mythos, a preview version of Anthropic's new frontier model, just solved a corporate network attack simulation in the time it takes a human expert 10 hours. In 2026, the median time-to-exploit collapsed from 1.6 days to 20 hours. Mythos signals the next order of magnitude. When a model can autonomously find thousands of zero-day vulnerabilities and generate exploits without human intervention, the assumption that human-speed detection can protect your enterprise is gone.

The biggest threat isn't coming over the wall. It's already inside your network.

The Attacker Doesn't Need Your Firewall

According to the Cloud Security Alliance's AI Vulnerability Storm briefing this week, the most severe vulnerability facing enterprises right now is the Unmanaged AI Agent Attack Surface, classified as a AAA Critical Risk. If an attacker wants your database today, they don't need to breach your perimeter. They need to hijack your highly privileged, unmonitored AI agent and ask it nicely.

And those agents are everywhere. A CSA survey released this week found that more than half of organizations have up to 100 unsanctioned AI agents running without clear ownership or oversight. Most security teams have no idea.

The Permission Creep Problem

Deep access isn't a mistake. A customer service bot needs billing records and customer PII to do its job. An HR assistant needs employee data. A coding agent needs the codebase. Access is the point.

The problem is what happens over time. A developer using Claude Code wants the agent handling more complex, multi-step tasks. The agent requests broader permissions. The developer approves because approving means more output. This keeps happening. Approval fatigue sets in. "YOLO mode" takes hold with the developer rapidly approving every permission request just to keep moving. An agent that started with narrow read-only access now has deep write access to a production codebase. A useful tool has quietly become a massive attack surface.

This isn't hypothetical. In a new Rubrik Zero Labs report, 38% of security, IT and AI executives reported an agent had already caused a sensitive data leak or exfiltrated data. Seventeen percent associated an agent with a destructive action.

Agents Break Things Just Trying to Be Helpful

Most threat models assume a bad actor. They shouldn't. In Rubrik's internal simulations, agents caused serious damage with no attacker involved - just an agent trying to complete its task when the normal path was blocked.

In our simulations, we've seen standard configurations spiral out of control. For example, when an approved Model Context Protocol server was unavailable, an agent dropped into the local terminal and used raw command-line tools to complete its task, bypassing all enterprise guardrails. Another agent that needed a GitHub token, unable to find it through normal means, ran a security dump-keychain command and extracted every stored password on the machine to locate the one it needed. No attacker. Just an agent finding a path to task completion.

Why Your Existing Tools Won't Catch This

For the last few years, the industry focused on model safety, mostly making sure chatbots don't hallucinate or say something inappropriate. A safe foundation model means nothing if the deployment architecture is compromised.

Legacy tools aren't built for this. DLP systems rely on keyword matching and static rules. Agents are creative and route around them without trying. They summarise, reformat, translate, and recombine information in ways that look nothing like the original data.

To give you an example. An attacker could instruct a financial agent to analyse a restricted revenue spreadsheet, then write a five-paragraph story about a bakery - with the first letter of every sentence spelling out upcoming acquisition targets - and send it externally. A legacy DLP tool sees a story about a bakery. It clears. You need a system that understands the intent of the workflow, not just what words appear in the output. To defend at machine speed, you need AI to govern AI.

The Sprawl Problem

Marketing teams are spinning up Copilot Studio bots. ML engineers are stringing together n8n workflows. Developers are deploying Claude Code agents. Nobody is building on one platform. Security teams have no single view, no visibility into configurations, no record of what these agents can access or what they're doing. The attack surface isn't just unmanaged - it's unknown.

Rubrik Agent Cloud: Built for This Moment

Securing this environment requires three things working together: knowing every agent that exists, understanding what they're doing in real time, and having a recovery path when prevention fails. That's what Rubrik Agent Cloud is built for.

Holistic Posture Management. RAC connects directly to your existing agent platforms - Copilot, n8n, Claude, Bedrock - and gives you a single management hub. Every new agent is discovered automatically, its capabilities mapped, its configurations and actions captured in real time. No more blind spots.

Intelligent Runtime Protection. RAC's Semantic AI Governance Engine uses a purpose-built small language model to evaluate the intent behind an agent's actions before an API call completes. If an attacker steals credentials and instructs a privileged Copilot agent to mass-download restricted source code, standard identity systems see a valid login. RAC understands the context of the workflow and when it sees lateral movement and data exfiltration it blocks it in real time.

Real-time Recovery and Resilience. Prevention eventually fails. When an agent manipulates sensitive files or takes down a production database, RAC's rewind capability lets you surgically roll back system state to the exact moment before the damage occurred - so you're not just stopping the bleeding, you're erasing the damage.

Mythos is a preview of what AI can do at full speed. The enterprises that get ahead of this won't be the ones who slowed down their AI initiatives. They'll be the ones who built the governance and resilience layer before they needed it.