New McKinsey research warns that frontier AI is allowing attackers to discover software vulnerabilities faster than organisations can repair them. With more than 10,000 serious vulnerabilities identified through Anthropic’s Project Glasswing and remediation times rising, cybersecurity teams face growing pressure to rethink how they protect critical systems.

Artificial intelligence is changing the economics of cybersecurity, allowing software vulnerabilities to be discovered and potentially exploited at speeds that traditional security processes struggle to match. As advanced AI models become more capable of analysing code, businesses are facing an expanding gap between how quickly security flaws are identified and how long it takes to repair them.

A new McKinsey report, How Frontier AI Is Rewriting Software Security Rules, examines how these developments are affecting enterprise cybersecurity and the responsibilities of technology leaders.

The research argues that organisations can no longer depend entirely on periodic vulnerability scans, manual reviews and lengthy patching schedules. Instead, businesses need to integrate security into software development, improve automated detection and establish stronger controls over AI-powered systems.

The challenge is becoming more urgent as attackers gain access to tools capable of identifying weaknesses across large volumes of software, while defenders continue managing complex infrastructure, legacy applications and limited engineering resources.

AI Can Discover Software Vulnerabilities Faster Than Security Teams Can Fix Them

For decades, identifying serious software vulnerabilities required substantial technical expertise and considerable time. Security teams often had an opportunity to assess reported weaknesses and prepare fixes before attackers developed reliable methods to exploit them.

Frontier AI is changing that process.

Advanced models can analyse source code, examine configurations and identify potential security weaknesses across software applications. Some systems can also assist with testing whether identified flaws could be exploited.

According to McKinsey, the increased speed of vulnerability discovery is creating additional pressure on organisations already managing extensive backlogs of unresolved security issues.

One example comes from Anthropic’s Project Glasswing, launched in April 2026 to explore how its Claude Mythos Preview model could support defensive cybersecurity research.

By May, participating organisations had identified more than 10,000 high- or critical-severity vulnerabilities using the model, according to Anthropic’s reported findings.

Several participants also reported increases of more than tenfold in their vulnerability discovery rates.

The research identified longstanding security weaknesses, including a previously undiscovered Firefox vulnerability dating back approximately 20 years and an OpenBSD flaw that had existed for 27 years.

These results demonstrate the potential value of AI-assisted security research, but also illustrate how quickly the volume of reported vulnerabilities could increase.

The Gap Between Discovery and Remediation Is Growing

Finding a vulnerability does not automatically mean that a business can repair it quickly.

Software updates often require testing, compatibility checks and approval before they can be deployed across production systems. Companies operating critical infrastructure may also have limited opportunities to interrupt services.

McKinsey cites research indicating that the time between public disclosure of a critical vulnerability and observed exploitation has shortened considerably, with some vulnerabilities being targeted within hours.

Meanwhile, Verizon’s 2026 Data Breach Investigations Report found that the median time required to fully remediate known exploited vulnerabilities increased from 32 to 43 days in the dataset it examined.

Only 26% of those vulnerabilities were fully remediated during the observed period.

This creates a substantial difference between the speed at which attackers can act and the time defenders need to implement reliable fixes.

For organisations managing financial systems, customer databases or essential services, that delay can increase exposure to cyberattacks.

The issue is also financial. Security teams must devote engineering resources to investigating vulnerabilities, while development teams may need to postpone product improvements to complete urgent repairs.

Why Traditional Cybersecurity Strategies Are Becoming Less Effective

Many enterprise security programmes were designed around regular testing cycles, risk assessments and manual remediation.

These processes remain useful, but they can become difficult to sustain when automated tools generate large numbers of findings.

AI-based scanners may identify weaknesses in source code, cloud configurations, third-party libraries and access controls. Each finding then requires assessment to determine whether the vulnerability is genuine and whether an attacker could reach the affected system.

McKinsey recommends using multiple AI models alongside conventional scanning tools, since different systems may identify different vulnerabilities.

The report also encourages organisations to combine findings into a shared record that removes duplicates and connects each problem to its affected applications and responsible teams.

This allows security specialists to prioritise issues based on actual exposure rather than treating every automated warning as equally urgent.

For example, a vulnerability in an internet-facing authentication system may require immediate attention, while a similar weakness in an isolated application could present a lower immediate risk.

The aim is to direct limited engineering resources towards problems that pose the greatest potential harm.

AI Coding Agents Need Stronger Security Controls

The adoption of AI-assisted software development introduces another challenge.

Coding agents can write, modify and test software, reducing the time required for certain development tasks. However, these capabilities can also introduce security concerns if agents receive excessive permissions or interact with untrusted information.

An agent reviewing external documentation or third-party code could encounter malicious instructions intended to influence its behaviour.

McKinsey recommends treating coding agents as privileged actors with defined identities, restricted permissions and accountable owners.

Agents should receive access only to the systems and information required for their assigned tasks. Production credentials, sensitive customer data and critical infrastructure should remain outside their authorised environment unless access is explicitly justified and controlled.

The report also recommends separating the authority to propose software changes from the authority to approve them.

AI-generated code should undergo independent testing, while changes affecting security controls, authentication or other sensitive functions may require human approval before deployment.

These measures are intended to prevent automated development systems from weakening the safeguards designed to protect enterprise applications.

Four Areas Businesses Must Address to Improve Cybersecurity

McKinsey identifies four connected areas that organisations should improve as frontier AI changes software security.

The first concerns cybersecurity practices, including continuous vulnerability discovery, AI-assisted testing and better prioritisation of security findings.

The second focuses on the software engineering operating model. Businesses need development processes that incorporate security checks from the beginning, rather than relying entirely on reviews performed after code has been written.

The third involves risk management and governance. Organisations should establish clear limits on how long serious vulnerabilities can remain unresolved, with named owners responsible for accepting and managing any remaining exposure.

The fourth concerns technical resilience, including stronger access controls, network segmentation, encryption, reliable backups and the removal of outdated systems.

These areas require coordination between cybersecurity specialists, software engineers, risk managers and executive leadership.

Improving detection without increasing remediation capacity could create larger backlogs, while investing in technical safeguards without clear accountability may leave serious weaknesses unresolved.

Regulators Are Increasing Their Attention to AI-Enabled Cyber Risks

Financial regulators are also examining how AI could affect the cybersecurity risks faced by banks and other institutions.

McKinsey highlights discussions held in April 2026 between senior US financial officials and major banking executives concerning the capabilities of Anthropic’s Mythos AI model.

In Europe, the European Central Bank’s Banking Supervision division requested that supervised institutions prepare action plans addressing vulnerability management, monitoring and AI-enabled cyberdefences.

The July 2026 request required affected institutions to submit plans by 31 October, with attention directed towards improving patching processes and reducing exposure involving critical suppliers and systems.

These developments reflect growing regulatory interest in whether established cybersecurity arrangements remain suitable as AI accelerates vulnerability research and potential attacks.

For financial institutions, compliance increasingly requires evidence that vulnerabilities are identified, prioritised and addressed within acceptable timeframes.

A 90-Day Plan for Strengthening Enterprise Security

McKinsey recommends beginning cybersecurity improvements with a limited group of critical applications rather than attempting to redesign every system simultaneously.

During the first 30 days, organisations should identify their most important systems, establish ownership and conduct targeted vulnerability assessments using multiple detection methods.

The following month can focus on introducing security controls into software development, improving remediation workflows and addressing weaknesses revealed by the initial assessment.

By the third month, organisations should be able to evaluate whether their changes have reduced exposure, improved response times and prevented recurring software defects.

The report also recommends monitoring supplier performance and identifying legacy applications that should be upgraded or retired.

For business leaders, these efforts provide a way to measure security improvements through operational results rather than relying solely on the number of vulnerabilities discovered.

What Frontier AI Means for the Future of Cybersecurity

The growing capabilities of AI create opportunities for both attackers and defenders.

Security teams can use advanced models to analyse code, examine suspicious activity and identify threats that conventional tools may miss. At the same time, malicious actors can use similar capabilities to search for weaknesses and accelerate parts of the attack process.

This changes the expectations placed on enterprise cybersecurity teams.

Organisations will need to reduce the time required to contain serious threats while improving how software is designed, tested and maintained.

Human oversight will remain important, particularly when automated systems propose changes to critical infrastructure or make decisions involving sensitive information.

The McKinsey research suggests that businesses able to combine AI-assisted security tools with stronger engineering controls and clear accountability will be better positioned to manage the growing volume of software vulnerabilities.

As frontier AI continues advancing, cybersecurity performance will depend on how quickly organisations can turn discoveries into verified fixes and prevent the same weaknesses from returning.

Source:
1. https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/how-frontier-ai-is-rewriting-software-security-rules