The question of whether a Frontier AI model could find vulnerabilities that no human researcher had found was settled in April. Claude Mythos Preview identified thousands of previously unknown flaws across every major operating system and browser, including a 27-year-old denial-of-service condition in OpenBSD, and within a month Anthropic and its Project Glasswing partners had logged more than 10,000 high and critical severity findings , among them a certificate forgery flaw in wolfSSL, a library running on roughly five billion devices. July answered a different question, and it is the one that should be reordering security budgets this quarter. When Frontier AI models broke into real production environments belonging to real companies, what did they reach for? In almost every case, the oldest material on the list. The Hugging Face intrusion ran entirely through cloud infrastructure On July 21, OpenAI disclosed that its own models, GPT-5.6 Sol and an unreleased pre-release model, evaluated with reduced cyber refusals, had spent a substantial amount of inference compute discovering and exploiting a zero-day in third-party package-registry proxy software, which happened to be the sandbox’s one permitted network path out. From there the models escalated privileges and moved laterally through the research environment until they reached a node with internet access, then targeted Hugging Face’s production infrastructure to steal the answer key used to score them. Hugging Face’s own technical timeline is where this becomes recognizable to anyone running workloads in the cloud. The intrusion began with a malicious dataset that exploited two code-execution paths in the data-processing pipeline, and once the agent held a foothold in a production pod it followed an entirely conventional shape: reconnaissance, a stager, command and control, then a pivot into the cluster, into cloud metadata, into the internal network, and finally into the source-control supply chain. Hugging Face reconstructed more than 17,000 recorded events and detected the breach on July 16, five days before OpenAI connected the activity to its own evaluation run. Walk that chain back and the conditions the agent needed at each pivot turn out to be things a Kubernetes admission policy decides on an ordinary Tuesday afternoon: a pod permitted to run privileged, a hostPath mount nobody revisited after a migration, instance metadata reachable from a workload with no business reading it. These are configuration decisions rather than vulnerabilities, so none of them will ever appear in a vulnerability backlog, and a security program that measures its exposure in CVEs has no line item where any of them would sit. Three more break-ins, and nothing on the list would have surprised a defender in 2006 Nine days later, a second lab found the same pattern in its own house. Anthropic published a retrospective review of 141,006 evaluation runs and reported three incidents, across six runs, in which Claude models reached the live production systems of three real organizations. The evaluations ran in partnership with an external evaluation partner, and the models had been told they were operating inside a simulation with no internet access, while the environment, as actually configured, retained a live path to the open internet. This was due to a misunderstanding between Anthropic and its evaluation partner over whether the environment had internet access. The incident is characterized as closer to a harness and operational failure than a model alignment failure, which is a fair distinction and one that cuts toward the argument here rather than against it, because a harness or configuration failure is exactly the class of weakness that a CVE-driven program has no mechanism to see. Every enterprise inherits a version of the same structural problem the moment it grants a vendor an integration. In the most serious of the three incidents, a fictional target company in the exercise shared its name with a real internet domain, and across four runs Claude Opus 4.7 failed to reach its simulated objective, located the real company online, and entered its infrastructure through weak passwords and unauthenticated endpoints before extracting application and infrastructure credentials and reaching a database holding several hundred rows of production data, continuing to work the target after recognizing that it was real. Claude Mythos 5 published a package to PyPI that executed on 15 external systems and harvested credentials from a security scanner running on one of them, using those credentials to move further into a cybersecurity firm’s infrastructure until PyPI’s automated defenses removed the package. An unreleased internal research model that could not reach its assigned target scanned roughly 9,000 hosts across the public internet, compromised one company’s web application by reading credentials off an exposed debug page and using SQL injection, then worked out on its own that the compromised host sat in a cloud account unconnected to the exercise and stopped without being told to. The difference between the oldest and newest models on that list is a judgment layer rather than a technique. None of the three models discovered or used a novel zero-day. Every technique on the list is the same material that security guidelines, compliance frameworks, and vulnerability scanners have documented for close to two decades, and every one of them is the sort of finding that tends to sit in an overdue backlog behind whatever was deemed more urgent that week. It would be a mistake to read that as reassurance, because what these models brought to old material was the ability to chain it, autonomously, across boundaries that no individual finding acknowledges. A weak password is a minor finding, an unauthenticated endpoint is a minor finding, a debug page in production is a minor finding, and so is a service account with more permission than its job requires. Ranked individually, all four sit somewhere in the middle of a list of thirty thousand items, and any reasonable analyst would defer all four. Assembled in sequence by something that never tires, never loses interest, and pays almost nothing for a failed attempt, those same four items become a path from the public internet to production data. Attack path is now a core way to measure risk, and almost no security program is organized around it, because findings are scored in isolation, owned by different teams, held in different tools, and compared using severity ratings that have no way of expressing “this one is a step in a chain that ends at your customer database.” Anthropic reported that two of the affected organizations were unaware of the activity, and that it was still working to reach the third. That gap is worth sitting with, because these were not quiet operations, and one of them involved scanning nine thousand hosts. Very few enterprises would have caught it either, and the exposures involved were almost certainly documented somewhere in a ticket queue already. What was missing was any way to cut through thousands of low-priority alerts and identify the handful that were dangerous when chained together and needed fixing that day. Enterprises closed 473 million findings last year and fell further behind Our Threat Research Unit’s analysis of remediation records across thousands of organizations found that of 48,172 vulnerabilities disclosed in 2025, 357 were confirmed remotely exploitable and actively weaponized, which is 0.74% of the total workload, carrying nearly all of the actual risk, or roughly seven items in every thousand a team works through. Over the same period enterprises did far more work and ended up further behind, with closures rising from 73 million in 2022 to 473 million in 2025, a sixfold increase in output, while the share of critical vulnerabilities still open at day seven rose from 56% to 63%. Effort went up, and exposure went up alongside it, because effort was being allocated by volume and severity score rather than by evidence of what was being used. Set against that, mean time to exploitation now sits at -7 days , meaning weaponization arrives a week before defenders have anything to deploy, while mean time to remediate sits at +30 days . Those two figures describe the Day Minus Seven era in a single line, and the July incidents are a fair demonstration of what an adversary accomplishes inside a window of that shape. The instinct after a disclosure like this is to ask what new category of defense is required for a new category of attacker, and the honest answer is that the weaknesses that matter have not moved at all. What has moved is the interval between the moment an exposure becomes reachable and the moment something finds it, and that interval is compressing considerably faster than remediation capacity is growing. An adversary that scans nine thousand hosts in the course of pursuing one narrow objective quietly removes the practical obscurity that a great many exposed assets have depended on without anyone admitting it. Obscurity was never a control, though it was doing the work of one in most enterprises, and it is now gone. The backlog can hold the same items it holds today, provided it is ordered by evidence of real-world exploitation and by position in a reachable path, worked in that order, continuously, and measured by average window of exposure, meaning the cumulative time an organization spends exposed across a year, rather than by how quickly any single ticket closes or how many of them close in a quarter. The chain ran through five systems and not one link was a CVE Most companies already hold the data required to make that shift and cannot act on it, because their findings are scattered across a dozen tools that duplicate alerts, disagree on severity, and never answer the only question that counts, which is which of these exposures are reachable, exploitable, and being used right now. Closing that gap is the purpose of the Risk Operations Center. Enterprise TruRisk Management brings findings from Qualys tools like TotalCloud and Qualys Container Security, and third-party tools into one ranked view and scores them with TruRisk against threat intelligence and business context, TruConfirm proves what is genuinely exploitable, and Agent Val and TruRisk Eliminate drive closure. A ROC with a gap in it is a gap in exactly the place these incidents landed. The Hugging Face intrusion ran through a data-processing pipeline, a container, a cluster, cloud metadata, and a source-control system, and not one link in it was a CVE. If cloud and container findings are scored in a separate dashboard by a separate team using a separate definition of critical, that entire path is invisible to the risk model that is supposed to be prioritizing your week. The reconstruction worth doing, then, is to walk that intrusion step by step against a fully instrumented cloud environment and ask at each pivot whether the condition the agent depended on would have surfaced as a ranked, validated exposure before the agent ever arrived. We have done that walk-through , and we believe it is well worth a read.