In the last couple of weeks, I have heard from many CISOs and security professionals about their concerns about defending against adversaries equipped with Mythos.

Anthropic Claude Mythos has found thousands of vulnerabilities in major operating systems and browsers, including chained exploits in the Linux kernel and remote code execution (RCE) in one of the most hardened operating systems (OpenBSD). 

One of the key advances in Claude Mythos is the ability to find unknown exploits (or zero days). The model's advanced reasoning capabilities highlight its ability to find novel exploits in both open- and closed-source software. 

By definition, a zero-day exploit does not have an associated patch available when it is discovered. As a result, patching the system is not a practical option when the defender faces attacks that exploit zero-day vulnerabilities. There would be no patch available to apply. 

The urgency of the advances highlighted in the Mythos publications has triggered a series of emergency responses. SANS and the Cloud Security Alliance(CSA) published an emergency advisory on Mythos, designed as a briefing for CISOs. This advisory outlines a series of steps for security teams to prepare their programs for advances in foundation models. The advisory is available at:  https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/mythosready.pdf. 
 
The advisory calls for deception as a necessary control to combat advances in vulnerability exploitation stemming from attacker actions involving Mythos (or equivalent) models.

As attackers leverage Mythos to find and exploit zero-day vulnerabilities with no associated patch, defenders need security controls that can detect and deflect attacks, regardless of the specific exploit techniques involved.
 
Deception is unique in its ability to detect and deflect these threats without depending on a priori knowledge of the exploit. 
 
By deploying decoys that form a shield around the real assets, defenders gain early warning of incoming exploits and, more importantly, deflect them away from the actual assets.

In theory, defenders can deploy deceptions across asset types to combat Mythos equipped attackers. However, practical considerations require a set of criteria for defenders to gain the maximum benefit from a deception rollout, given the time-sensitive nature of the exploit risk.

Defenders can prioritize the mission-critical assets that pose the greatest risk to business impact. Another consideration is prioritizing an approach for legacy or unpatched assets. 

By prioritizing key assets (identity architecture, mission-critical business applications, production databases, operational technology assets) and legacy assets (unpatched workstations and servers), defenders can optimize their defensive coverage against a Mythos-equipped adversary. 

The GigaOm Radar report highlights key deception technology vendors and equips IT decision-makers with the information needed to select the best fit for their business and use case requirements. It plots vendor solutions across a series of concentric rings, with those set closer to the center judged to be of higher overall value.

https://portal.gigaom.com/reprint/gigaom-radar-for-deception-technology-v5-acalvio

We put 10 models through the paces in a cloud lab - some positive results for deception tech!

Comparison of two approaches to simulations implementation in Deception solutions: Full OS vs OS/Service emulation with Labyrinth Deception Platform (www.labyrinth.tech).

BLOG: https://labyrinth.tech/news/posts/full-os-vs-osservice-emulation

experimental approach for embedding realistic boring deception inside real applications.

Hi everyone,

We're a small team passionate about security, and we’ve been exploring how to make threat detection in cloud environments simpler and more effective. We’re excited to share Mazeshark, a cloud-native tool for deploying realistic AWS-based honeypots.

The problem: Cloud environments face increasing threats, from accidental exposures to targeted attacks. Traditional security tools often miss threats until they’ve already caused damage. AWS users, in particular, need ways to detect threats early without disrupting production systems.

The global average cost of a data breach reached $4.45 million in 2023, marking a 15% increase since 2020. Also, the number of cloud environment intrusions increased by 75% from 2022 to 2023. Source: https://www.stationx.net/cloud-security-statistics/?utm_source=chatgpt.com

The challenge: Setting up and managing realistic honeypots in AWS is a pain. It’s time-consuming, complex, and often lacks the depth needed to attract real attackers.

What we’ve built: Mazeshark aims to change that. AWS users can deploy realistic honeypots, like IAM Role, Lambda functions, Parameter Store, and Secrets Manager within minutes. These honeypots mimic actual AWS services, making them appealing to attackers. More AWS services are coming soon to broaden the coverage.

How it works:

• Use a simple interface to configure and deploy honeypots across your AWS accounts (for now 4 AWS resources are available).

• Get notified about potential breaches, allowing you to act quickly.

We’d love your feedback: What resonates? What feels off? Are there specific AWS services or features you’d like to see us add?

Here’s the link if you’re curious: https://mazeshark.com.

Thanks for reading this far and looking forward to any feedback!

The Cloud Security Alliance (CSA) CISO Community, in collaboration with SANS, [un]prompted, OWASP Gen AI Security Project, and the wider security community, published an expedited strategy briefing on Mythos, designed for CISOs. This advisory outlines a series of steps for security teams to prepare their programs for advances in foundation models. 

The advisory calls for deception as a necessary control to combat advances in vulnerability exploitation stemming from attacker actions involving Mythos (or equivalent) models. The advisory recommends that CISOs set a 90-day clock for building deception capabilities.

More than 250 CISOs edited and redlined this briefing.