Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense

Frontier AI is fundamentally changing the pace of cybersecurity. For defenders and adversaries alike, it compresses the time required to discover vulnerabilities, assess exploitability, and act.

AI models can reason across entire codebases, identify complex vulnerability chains, and generate exploit paths at a speed and scale that was previously impossible. That's a breakthrough for defenders, but it's also a preview of how quickly adversaries will evolve. 

At CrowdStrike, we wanted to answer a simple question: How do we turn frontier AI into better security outcomes?

Over the past several months, we've been working with frontier AI models, including Anthropic's Mythos Preview, to understand how their capabilities perform in real-world vulnerability research and other security use cases. Along the way, we uncovered a series of lessons that extend well beyond vulnerability discovery, from how frontier AI should be operationalized to how it will reshape adversary tradecraft to what organizations must do to continuously strengthen cyber defense. 

This blog explores the first of those lessons: The model is only part of the equation. The real differentiator is how it's harnessed.

Frontier AI Changes the Economics of Vulnerability Discovery

Security leaders are facing a fundamental shift. The number of publicly disclosed vulnerabilities has dramatically increased over the past decade, and the pace continues to accelerate. By late June 2026, the number of published CVEs this year had already reached nearly two-thirds of the total reported during all of 2025 (Figure 1). Defenders aren't simply managing more vulnerabilities; they're managing an expanding attack surface that is growing faster every year.

The window to respond is shrinking. The CrowdStrike 2026 Global Threat Report found a 42% year-over-year increase in zero-day vulnerabilities exploited before public disclosure. Attackers are weaponizing vulnerabilities earlier in their lifecycle, giving defenders less time to identify, prioritize, and remediate risk before exploitation begins. Frontier AI will only accelerate this trend.

When frontier AI models first demonstrated breakthrough performance on software engineering and reasoning tasks, we wanted to understand what those advances meant for cybersecurity. Could these models fundamentally change vulnerability research? Could they help security teams discover vulnerabilities faster, understand exploitability more accurately, and ultimately improve defensive outcomes?

To answer those questions, we evaluated several frontier AI models, including Anthropic's Mythos Preview, across a range of real-world vulnerability discovery tasks.

The results confirmed what many in the industry are already seeing: Frontier AI represents a significant advance in vulnerability research. These models can reason across large codebases, identify subtle relationships between vulnerabilities, and explore potential attack paths with a level of sophistication that was previously difficult to achieve at scale.

Frontier AI models can reason across a wider aperture; as a result, they can recognize that what appears to be a low-severity information disclosure vulnerability becomes far more dangerous when combined with a memory corruption vulnerability and a privilege escalation path elsewhere in the application. It can evaluate whether existing mitigations can be bypassed, assess how an attacker might chain multiple weaknesses together, and produce a coherent attack narrative rather than a disconnected list of findings.

This capability has profound implications for defenders. As AI accelerates vulnerability discovery, it will compress the time between discovery and exploitation. Organizations can no longer assume they have days or weeks to patch before attackers move. They must separate meaningful risk from overwhelming noise and translate AI-driven discovery into actionable security outcomes. On the flip side, the same advances give defenders an unprecedented opportunity to move faster, prioritize more effectively, and respond with greater confidence, provided they harness AI properly.

The Harness Matters as Much as the Model

Our testing exposed another important breakthrough: Finding vulnerabilities is only part of the challenge. Security teams need to know which findings represent real risk and which can safely be ignored.

In our earliest tests, frontier AI models generated thousands of potential vulnerabilities. While many were legitimate, the majority proved to be theoretical, unreachable, or impossible to reproduce. The volume of findings quickly overwhelmed their value. So rather than asking which frontier model performed best, we began asking a different question: How do we operationalize frontier AI to gain a trusted view of vulnerability risk?

As we continued our testing, one conclusion became increasingly clear: The frontier model wasn't the biggest differentiator. The way it was applied was.

Rather than treating the model as a standalone capability, we built a security harness around it, combining structured threat modeling, exploit validation, workflow orchestration, and the deep security expertise embedded throughout the CrowdStrike Falcon® platform.

Each stage serves a purpose. Threat modeling focused analysis on code that was reachable by an attacker. Validation reduced theoretical findings before they reached analysts. Exploit verification determined whether vulnerabilities could be chained together and reproduced in realistic environments. Together, these steps transformed raw AI output into actionable vulnerability intelligence.

The results are profound. Using the same class of frontier AI models with different workflows produced dramatically different outcomes. A generic approach yielded false-positive rates approaching 80%. Applying CrowdStrike's security harness reduced that rate to approximately 20% while maintaining exceptional vulnerability discovery capability.

More importantly, the improvement wasn't model-specific. It came from combining frontier AI with structured workflows, rigorous validation, and deep security expertise. As the pace of model innovation accelerates and organizations gain access to an expanding ecosystem of capable frontier models, the differentiator won’t necessarily be those with access to the newest and most powerful models. It will be the ability to operationalize AI to consistently deliver trusted security outcomes.

This lesson applies equally to defenders and adversaries. Sophisticated threat actors won't simply adopt frontier AI; they'll engineer workflows around it to accelerate vulnerability discovery and exploitation. Defenders must do the same by applying AI in ways that improve speed and confidence rather than simply increasing volume.

What We Found

Leveraging Mythos Preview along with our proprietary harnesses optimized for vulnerability research, CrowdStrike analyzed nine categories of open-source software: network infrastructure, browsers, AI and developer tooling, virtualization platforms, search services, system software, databases, cryptographic libraries, and web sanitization tools.

The findings are significant in both volume and severity. Across these categories, the pipeline surfaced more than 2,400 vulnerabilities. More than one in four findings (26%) were rated high or critical severity. Approximately 50% of confirmed findings carried working proof-of-concept exploits generated or validated by the pipeline.

The main takeaway is scale. In a matter of days, CrowdStrike’s AI-driven vulnerability research pipeline surfaced more than 2,400 vulnerability findings across 43 different products and nine major open-source software categories. Frontier AI, when paired with the right harness, can materially change the speed and scale of vulnerability discovery, helping defenders find and prioritize risk faster.

A note on these findings: Results were generated through automated AI testing with human oversight, but not all have yet undergone full human triage with open-source maintainers and vendors. CrowdStrike is following responsible disclosure processes and will share additional details as this process is complete. Severity ratings, exploitability assessments, and proof-of-concept validity should be treated as informational at this stage.

Three Lessons for Security Leaders

Our testing reinforces three important lessons for security leaders preparing for the frontier AI era.

1. Evaluate AI by outcomes, not models

The rapid pace of innovation in frontier AI means there will always be another model release, another benchmark, and another leaderboard. Those advances are only part of the equation. The real question isn't which model performs best in isolation; it's how effectively that model can be operationalized to solve real security problems.

For defenders, success should be measured by outcomes: Can AI reduce false positives? Can it identify exploitable vulnerabilities with greater confidence? Can it integrate into existing security workflows and help teams make faster, more informed decisions?

The organizations that realize the greatest value from frontier AI will be those that combine advanced models with security expertise, structured validation, and operational workflows that produce trusted, actionable results.

2. Prepare for AI-accelerated vulnerability discovery

Defenders and adversaries alike will benefit from faster discovery and better analysis. As AI compresses the time between vulnerability discovery and exploitation, organizations can no longer assume they will have weeks, or even days, to remediate every critical vulnerability before attackers use them.

Patching remains an essential security discipline, but it is no longer sufficient on its own. Security leaders should shift their focus from vulnerability management as a backlog exercise to continuous exposure management by understanding which assets are most critical, which vulnerabilities are most likely to be exploited, and where compensating controls can reduce risk while remediation is underway.

3. Build resilience, not just response

Frontier AI is not a cyber superweapon. It is an accelerator.

The organizations best prepared for the AI era will build environments that are resilient by design. This means assuming sophisticated adversaries will eventually gain an initial foothold and designing security architectures that limit what happens next. It means protecting identities as aggressively as endpoints, reducing unnecessary privileges, continuously validating exposure, monitoring for policy changes, governing AI systems, and automating detection and response across the attack surface.

Most importantly, it means creating a continuous feedback loop where offensive research strengthens defensive capabilities. This enables organizations to adapt as quickly as the threat landscape evolves.

Frontier AI represents one of the most significant advances in cybersecurity in decades. But the future of cybersecurity won't be defined by AI alone. The organizations that succeed will be the ones that combine frontier AI with deep security expertise, continuous validation, and a closed-loop approach that turns offensive discovery into stronger defense.

That's the future CrowdStrike is building.

Learn more

The findings in this blog are a starting point. Here’s how to take action:

• Download our guide to explore the five steps for frontier AI security readiness.
• Visit our Frontier AI Readiness and Resilience Service page to learn about CrowdStrike’s approach to frontier AI and see how CrowdStrike Services can help.
• Learn how Falcon Exposure Management can help you discover, prioritize, and manage exposure risk across your environment. Check out our YouTube channel.
• Join us at Fal.Con 2026 as we bring together cyber leaders from across the industry to help secure the AI revolution.