The release of Anthropic’s Claude Mythos has sparked a firestorm of debate, but perhaps no one captured the gravity of the moment better than the recent New York Times opinion piece, “The AI Hackers Are Already Here.” The article underscores a chilling new reality: we have officially entered the era of “automated asymmetry,” where frontier models can chain together vulnerabilities at a speed that makes human-led defense look like it’s standing still.

While the Times focuses on the systemic risk to national infrastructure, the implications for those of us in the identity space are even more immediate. If Mythos can autonomously find a 27-year-old flaw in an OS kernel in minutes, it won’t break a sweat dismantling a legacy account recovery flow or a brittle authentication logic. For CIAM practitioners, it is the signal that our traditional defense perimeter has been bypassed and it’s time we rethink what “customer trust” looks like.

For Customer Identity (CIAM), Mythos-class AI finds the logical cracks in your Customer Journey. Meaning, it can map out your registration, authentication, and account recovery flows and then simulate a million permutations of “Identity Injection” in seconds. 

“Customer Identity recovery flows are now a major liability”

Top of Mind for the CTO/CIO:

• API Shadow Identity: Mythos will find that old, forgotten “test” API endpoint you left open in 2022. If it’s not behind your primary identity gateway, it’s a wide-open door.
• Infrastructure as Code (IaC) is Identity: Since Mythos can read and exploit code patterns, your Terraform scripts for your identity stack are now as sensitive as your root keys.
• Session Integrity: If an AI can hijack a session token after the initial MFA, the MFA was useless. Continuous Access Evaluation (CAE) is the most effective way to stop a model that moves so quickly.

Brief:

1. Slow Move Vulnerability

Historically, when a new vulnerability was discovered (like a flaw in an OIDC implementation), we had a “buffer.” Attackers had to write scripts, test them, and weaponize them. Mythos reduces that “vulnerability-to-exploit” window to near-zero.

The Practitioner’s Reality: If your CIAM strategy relies on a 30-day patch cycle or a quarterly penetration test, you’re already compromised. We have to move toward Continuous Identity Orchestration—where security signals from the edge (like Cloudflare or Akamai) can automatically trigger a step-up to a device-bound Passkey the second a Mythos-style bot starts probing a specific endpoint.

2. Logic Bombing the Account Recovery Flow

We’ve spent years securing the front door (Login). But Mythos is exceptionally good at “reasoning” through the back door: Account Recovery.

Mythos can analyze your “Forgot Password” logic and find ways to chain together minor data leaks (PII from the dark web) with automated social engineering. It can simulate a “distressed customer” to a helpdesk or an automated bot with enough nuance to bypass standard knowledge-based authentication (KBA).

The Pivot: We have to treat the Account Recovery flow as a high-risk transaction, not a support task. NIST 800-63-4 (which I’ve written about recently) is the floor, but Mythos is the ceiling. We need to move toward “Verified Recovery,” where a customer must present a government-issued ID or a verifiable credential from a digital wallet to regain access—no exceptions.

3. Fighting AI with AI: The Defensive Mythos

The only way to beat a Mythos-class attacker is with a Mythos-class defender. This is where we shift from “Identity Management” to “Identity Intelligence.”

We are entering an era where our CIAM systems must be Agentic. We need “Identity Defense Agents” that are constantly red-teaming our own public-facing APIs and login flows, looking for the same gaps an attacker would find, and closing them in real-time. At Next Reason, we’ve always said that identity is the foundation of trust. But in the age of Mythos, trust can’t be static. It has to be re-earned every millisecond.