HPE warns AI finds software flaws faster than firms can patch them

Mythos as the warning sign

HPE opens with an example from April 2026. According to the company, Anthropic's Claude Mythos found a bug in OpenBSD that had gone undetected since 1998, in one of the most heavily audited codebases in the world. In a few weeks it reportedly found thousands of previously unknown vulnerabilities across major operating systems and browsers, wrote working exploits, and chained them together with little human help.

Anthropic judged the model too dangerous to release but gave early access to a group of defenders through Project Glasswing. HPE draws a clear lesson for IT leaders: finding and exploiting a vulnerability no longer requires deep expertise or a lot of time. A breach still costs lost revenue, leaked intellectual property, damaged reputation and regulatory fines, but the time available to prevent one has shrunk.

Build early, manage continuously, prioritize hard

HPE argues that security checks only at release are a poor bet, noting that "$50 of AI spend can find a decades-old flaw." Mature programs, it says, build security into every stage: architectural threat analysis, security code reviews and static analysis during development, and penetration testing and vulnerability assessments before release. A flaw fixed at design time costs far less than one fixed in production.

Volume is a growing problem. HPE says AI-assisted developers write more code, and research shows that code carries roughly 10 times more security findings. Its recommended process is to collect findings from multiple sources, rank them, keep them in a data lake, assign them to the right team and track each against a defined SLA.

For ranking, HPE points to two public resources. The US Cybersecurity and Infrastructure Security Agency (CISA) publishes a Known Exploited Vulnerabilities (KEV) list of flaws already being exploited in real attacks. The Exploit Prediction Scoring System (EPSS) estimates the chance a vulnerability will be exploited in the next 30 days. Used together, the order of work is KEV-listed items first, then issues with an EPSS score above 0.5. HPE says its security team in HPE Private Cloud built VulnOps, a continuous vulnerability management process, on this basis.

Regulation, data in use and quantum risk

The EU Cyber Resilience Act (CRA) adds legal pressure. From September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents on tight timelines, with an early warning due within 24 hours. By December 11, 2027, products must meet secure-by-design requirements to carry the CE marking and be sold in Europe. HPE notes the reporting duty also covers products already in the field.

The company also recommends confidential computing, which protects data in use by isolating workloads in hardware-protected environments. Data stays encrypted in system memory, where only the CPU or GPU that needs it can decrypt it. HPE says multi-tenant environments need this protection, and that a growing number of large AI model providers now require confidential computing for on-premises deployments.

On quantum, HPE warns that quantum computers threaten public-key cryptography and could crack standard encryption keys in a few hours to a week. Adversaries can collect encrypted data today to decrypt later, a practice researchers call "harvest now, decrypt later." Health records, financial data and intellectual property are at risk, so replacing vulnerable algorithms has to start before quantum machines arrive.

What it means for enterprises

HPE's message is that slow scanning and later patching no longer holds. It tells organizations to design security in early, manage vulnerabilities continuously, assume the attacker has AI, meet the regulation, adopt confidential computing and prepare for quantum now. It adds that SLAs set last year may already be too slow, since researchers describe the time between discovery and active exploitation shrinking from months to hours.

The post is a vendor's view and promotes HPE Private Cloud, which the company says is working across all these fronts to support its users.