Machine vs machine: Cybersecurity enters a new era

Since the beginning of 2026, two high-profile incidents involving cutting-edge AI have made headlines and sent shockwaves through the cybersecurity community. In April, Anthropic restricted access to its new model, Mythos, after it identified thousands of vulnerabilities, many of them critical, in software used around the world. In July, its rival OpenAI revealed that, during internal sandbox testing, its AI agents had bypassed controls designed to prevent them from accessing the internet and hacked into systems belonging to Hugging Face, a platform for sharing AI tools.

Both companies have since made details of these incidents public, demonstrating that frontier large language models (LLMs) – the most advanced models currently available – have reached a new level of capability in identifying security vulnerabilities in software and operating systems. Their ability to work together, collaboratively and in a coordinated manner, is also becoming a reality. For the cybersecurity industry, these two developments combined represent not just a dramatic increase in the scale of the threat, but the dawn of a new era.

Machines can now systematically uncover vulnerabilities

"Vulnerabilities have always existed, and the industry has traditionally prioritised fixes according to their severity," explains Stéphane Lenco, Chief Information Security Officer at Thales. "What has changed with new models such as Mythos is that machines can now systematically identify vulnerabilities on a massive scale. It's like having a magnet that can pull every needle out of a haystack. This extraordinary acceleration changes everything."

Previously overlooked minor or long-standing vulnerabilities can now be combined to launch attacks against a system. "We now have to assume that any vulnerability could contribute to a major attack," Stéphane Lenco continues. "We can't afford to overlook anything. Vulnerabilities will need to be fixed across the board, and much faster than before. This represents an unprecedented disruption to the economics of vulnerability management."

And there is no turning back. Anthropic's decision to restrict access to Mythos, at least for now, is of limited consequence: leading AI developers are estimated to be only four to seven months ahead of open-source models. In other words, AI systems with comparable cybersecurity capabilities could soon become widely accessible.

"The days when launching a cyberattack required highly specialised knowledge are behind us," agrees Laurent Theringaud, a cybersecurity expert at Thales. "Today, even a novice equipped with a frontier AI model can launch an attack against software or a company. For now, however, these types of attacks still require very large numbers of tokens, potentially making them prohibitively expensive. That remains a limiting factor."

Building an end-to-end security continuum

Across Thales, there is a shared conviction that these emerging models demand a fundamental rethink of cybersecurity. This means addressing two priorities simultaneously: establishing a continuous approach to security, from product design through to operation, and integrating artificial intelligence throughout the entire protection lifecycle, from detecting vulnerabilities during software development and conducting penetration tests to improving incident response.

Having an end-to-end approach, with no blind spots, no silos and seamless coordination to ensure that no weakness is left for AI to exploit is now essential to building resilience. "This integrated approach is what will protect us. It is an absolute necessity," stresses Stéphane Lenco.

With technology advancing at breakneck speed and tomorrow's threats still unknown, organisations must secure every aspect of their systems, at every level. "Today, an attacker seeking to disable a radar could gain access through an employee clicking on a phishing email enhanced with a deepfake, or by exploiting a vulnerability in the product itself. The methods differ, but the outcome is the same. We need to be able to defend against both."

Thales draws on its cybersecurity expertise

Anticipating cyberattacks begins at the product development stage. By integrating AI-enhanced vulnerability management into the development process, teams can identify and fix weaknesses before software is even deployed.

"This enables us to build more robust solutions," explains Laurent Theringaud. But protection cannot stop there. The latest AI models can identify a zero-day vulnerability in software within tens of minutes of its release. This means that the entire approach to software updates and patch management needs to be rethought. "Once a product has been released, we need to be able to update it much faster than before – ideally, even in real time."

Despite these precautions, cyberattacks are inevitable. And humans alone will not be able to respond quickly enough. As Stéphane Lenco puts it: "To counter an attack accelerated by machines, you need machine speed!"

Thales therefore plans to deploy AI agents capable of detecting threats and responding at the same pace. But this comes with a fundamental requirement: their deployment must remain fully aligned with the Group's principles of trust, transparency and accountability.

In the age of artificial intelligence, cybersecurity is becoming an even more asymmetric contest. Attackers are bound by no rules or laws, while defenders must operate within a regulatory framework and uphold a clear set of values.

Like all European companies, Thales operates within the strict requirements of EU legislation, particularly the EU AI Act. This entails, among other things, monitoring the actions of AI agents, ensuring that the reasoning behind their outputs can be explained, and making sure that their behaviour complies with European ethical standards.

"Through the comprehensive framework we provide, we are helping to meet these requirements for oversight and explainability," concludes Stéphane Lenco.