AI just crossed the offensive-security threshold. You have six months.

The event

Anthropic disclosed Claude Mythos Preview on April 7. It scored 93.9% on SWE-bench Verified — a 13-point jump over Opus 4.6's 80.8% from February — and, without any cybersecurity-specific training, autonomously discovered thousands of high-severity vulnerabilities across Linux kernel, FFmpeg, OpenBSD, and every major browser. Including a 27-year-old bug in OpenBSD. Including an FFmpeg flaw that survived five million fuzzing runs. And, critically, it chains five separate vulns into novel exploit paths.

Alex Stamos put the open-weight parity estimate at roughly six months. Anthropic launched Project Glasswing the same day: 40+ companies (Apple, Google, Microsoft, Cisco, Broadcom) with $100M in Mythos credits, racing to scan and patch critical infrastructure before the capability commoditizes.

That's the story. Everything else on the tape this week rearranges around it.

Yes, but — the strongest counter-reading is that these capabilities emerged from general reasoning, so defenders get them too, and the net effect on security is neutral or positive. It doesn't hold. Offense scales with compute; defense scales with patching cycles, change windows, and vendor coordination. A world where every ransomware operator has a local 0day factory and no forensic trail is not a world where the defensive gains cancel out. Glasswing is the tell — you don't stand up a $100M coalition if you think the math is symmetric.

What compounds it

The supply chain your defenses depend on is failing in the same window. Trivy — the container scanner you probably have in CI right now — was compromised on March 19 and became the initial access vector for 340 GB exfiltrated from the European Commission across 42 internal clients and 29+ EU entities. The tool auditing your dependencies had more credential access than most of your production services. Meanwhile, Qilin and Warlock are running BYOVD attacks that disable 300+ EDR products at the kernel level, GrafanaGhost proved AI features are silent exfiltration channels invisible to SIEM, and 63% of 135,000+ public OpenClaw instances run with no authentication at all.

Every layer of the trust stack is being tested at once. Your scanner, your dashboards, your endpoint agent, your identity provider, your agent harness. And the code being pushed through all of it is increasingly not written by humans.

What the code layer looks like now

OpenAI's Frontier team shipped a 1M-LOC production Electron app in five months with roughly seven engineers, zero human-written code, and zero pre-merge human review. Codex is at 2M weekly actives growing 25% week over week. Vercel auto-merges 58% of PRs in its largest monorepo. GitHub went from 1B commits in 2025 to a 14B annual run rate, availability has dropped to ~90%, and Claude Code alone drove a 25x commit surge in six months while GitHub sits on flat per-seat pricing that captures none of it.

And the quality data underneath is bad. Controlled experiments now show AI coding tools produce 41% more bugs for a 26% speed gain. Chroma quantified an accuracy cliff from 95% to 60% as context grows. Meta's 85,000 employees burned 60 trillion tokens last month with an internal memo explicitly warning "token usage is NOT impact." Beck and Fowler — not people who chase hype — say AI tools degrade badly on the large complex codebases where enterprise value actually lives.

So the picture is: machine-speed offense arriving in six months, meeting a codebase that is being written faster, reviewed less, and shipping 41% more defects. The attacker gets the compounding curve. You get the debt.

The financial backdrop matters less than it looks

Anthropic disclosed $30B+ ARR, tripling from ~$9B in four months and passing OpenAI's $25B. That's a real number and it will reprice a lot of secondaries. But the 10pp gross-margin miss on inference costs, the 3.5 GW TPU deal that doesn't come online until 2027, and OpenAI's CFO getting frozen out of financial planning for questioning IPO readiness all point the same direction: API pricing is subsidized on borrowed time. Plan for 2-5x increases through 2027, and build model-agnostic orchestration now if you haven't. Anthropic already showed it will unilaterally re-price third-party harness access with a week's notice.

That's the boring version of the takeaway. The interesting version is that model choice barely matters — harness design shifts benchmark performance by 20+ ranks on its own. The moat is orchestration, memory, verification, and the humans who write the spec. Not the weights.

What to do this week

One action, specific, before Friday: run a Glasswing-gap audit on your production dependency tree. Enumerate every C/C++ library, media codec, kernel version, and browser engine you ship or ship on top of. Cross-reference against the public Glasswing partner list. Anything material that isn't covered by a partner's scanning scope is a component that will not get a defensive patch before the open-weight window closes. Those are the ones you replace, isolate, or put behind a much smaller blast radius — starting now, not after the first wave of CVE disclosures lands.

The second thing, which takes longer than a week but starts this week: instrument defect rate on AI-authored PRs as a first-class metric alongside velocity. If you can't see the 41% number in your own repos, you can't argue against the token-count leaderboard your CTO is about to build. And the leaderboard is already losing to the threat model.