Trending Topics
Trending
When AI finds flaws, your endpoint data has to keep up
Frontier models like Claude Mythos Preview are shrinking the gap between flaw and fix. We collaborated with Tanium on this sponsored article to understand how real-time endpoint data keeps AI-driven IT operations accurate, fast and under control.
In April, Anthropic said its Claude Mythos Preview model had found thousands of previously unknown flaws across every major operating system and browser. PHP2Shell, a pair of critical flaws in PHP, shows what that looks like in practice. Details leaked before the planned disclosure, frontier AI helped researchers find the flaws, and PHP shipped fixes the next day. For many teams, though, the patch was the easy part. So what does it take to respond at that speed, and where should teams begin?
What does governed autonomous IT look like in practice?
Think of it as a cycle. Software finds where a risk lives and ranks what matters most. It proposes a fix, then, inside limits people define, carries it out and checks that it worked. Routine, low-risk actions can run on their own. Higher-impact ones wait for a person to approve. A few are never handed over at all. Each step leaves a record that someone can review and reverse.
What challenges do IT and security teams face today?
Three problems keep coming up, and AI-driven discovery makes each of them harder. The first is visibility. PHP2Shell reportedly sat undetected for more than a decade. With models like Claude Mythos Preview surfacing flaws at scale, more long-hidden bugs are likely to come to light, and each one starts a fresh hunt for every affected copy. For these two flaws, the fix was a version upgrade. The hard part was finding every copy of PHP, including copies bundled inside other software or extracted by hand onto Windows machines that never registered as installed applications. Then teams had to work out which copies the internet could reach and check for signs of earlier attack. An inventory built from a periodic snapshot can’t answer those questions on the day they matter.
The second is tool-hopping. “Where does this run, and can the internet reach it?” is a simple question with a slow answer. Teams often pivot across an asset inventory, a vulnerability scanner and an external attack surface tool, each with its own view. Every hop adds delay, and every console is another chance to disagree with the last.
The third is pace, and it is where Claude Mythos Preview changes the sums. In April, Anthropic said the model had found thousands of previously unknown flaws across every major operating system and browser. Frontier AI also helped find PHP2Shell. Several security firms reported exploitation attempts before PHP released its fixes, and Cloudflare reported early attacks hours ahead of the patch. When AI can turn up flaws at that volume, the old rhythm of disclose, patch and verify assumes a gap that keeps shrinking. The question is no longer only whether a team can patch, but how quickly it can see what needs patching.
Put an AI agent on stale, fragmented data and these problems don’t go away. They scale, at machine speed.
Why does real-time endpoint data make autonomy trustworthy?
Endpoints are where work happens and where many attacks end up, so they are the ground truth for any decision about the estate. Four qualities make that data a sound foundation for autonomous action:
- Accuracy. Live data from the endpoints themselves, not a snapshot that was true last week.
- Speed. A short path from question to action, with no hopping between tools to reconcile answers.
- Control. Approvals and an audit trail, plus the ability to roll back, so any automated action can be reviewed and reversed.
- Shared truth. IT operations, security and the system of record working from one view, rather than arguing over whose data is right.
Matt Psencik, a threat research engineer at Tanium, put the visibility problem bluntly when PHP2Shell broke: “The installations that worry me most are the ones a security team doesn’t know it owns.”
How does AI fit in now that models like Mythos are in the picture?
AI sits on both sides of this. By Anthropic’s account, Claude Mythos Preview shows how quickly a model can find flaws, and attackers can use that kind of capability to build exploits too. It also helped researchers find the PHP2Shell flaws. For defenders, AI works best as the operator and the interface: it takes a plain-language question, works out what to ask of the data, and proposes or carries out the next step. But it is only as good as the data it is grounded in. A fluent answer built on outdated information is still wrong, just more confidently so. A model that can find thousands of flaws still can’t tell you which of them live on your machines unless it can see them. Keeping people in the loop where stakes are high is what makes automation safe to expand.
What are the practical first steps?
Teams don’t need to hand over the keys all at once. The can start here:
- Find every copy. Don’t stop at the installed-applications list. PHP2Shell showed that software bundled inside other products can slip past it. Compare your CMDB against what is really on your network, and record exact versions.
- Draw the lines. Rank systems by what the internet can reach, then decide which response actions run automatically, which need approval and which are never delegated. Write it down before an agent needs it.
- Pilot one low-risk workflow. Pick something contained, build approval into it, and read the audit trail before widening the scope.
Tanium Atlas was built to close more than one of these gaps. An operator asks a plain-language question and gets an answer from live endpoint data, not a periodic snapshot, which speaks to the visibility problem. There is no moving between consoles, which ends the hopping. And the operator can act on the answer inside limits the team sets, with every action recorded, which shortens the path from question to action while keeping people in control. Ready to see it in action? See a demo.
Also from our cybersecurity section
About The Author
