Get it Right the First Time

The uncomfortable truth is that Claude Mythos is not the real scandal. Nor is Claude Code, or the next model with a mythological name and a larger context window. The scandal is that so much of the modern digital estate is still built and deployed as if attackers are slow, manual and polite.

The reported AI-enabled ransomware cases do not read like science fiction. They read like a post- incident review from ten years ago, only faster. An exposed service. A known vulnerability. A missing authentication control. Secrets left where an application process can read them. Default credentials. Root database access. Weak segmentation. Poor egress control. A production system that was never treated as hostile ground.

AI changes the tempo. It lowers the skill threshold. It allows an attacker to try, fail, adjust and try again without waiting for a tired human operator to notice the error. That matters. But it does not change the old lesson. Most attacks still need somewhere to land, something to steal, somewhere to move, and something valuable to destroy.

AI changes the tempo. It lowers the skill threshold. It allows an attacker to try, fail, adjust and try again without waiting for a tired human operator to notice the error. That matters. But it does not change the old lesson. Most attacks still need somewhere to land, something to steal, somewhere to move, and something valuable to destroy.

A properly engineered product gives the attacker less of each. It authenticates dangerous functions. It validates input on the server. It does not execute user-supplied data. It does not store cloud keys in plain sight. It uses least privilege by design. It logs the things that matter. It fails closed. It ships with secure defaults rather than asking every customer to become a forensic security engineer after deployment.

This is where the AI panic becomes too convenient. It lets the industry point at the model instead of the product. It lets vendors describe old negligence as a new threat. Yet a great deal of the attack chain would have been broken long before Mythos, or anything like it, had room to matter.

The future risk is real, but the first answer is not exotic.

• Build the product properly.
• Patch what is exposed.
• Remove secrets from reach.
• Segment the network.
• Control egress.
• Test recovery.
• Monitor behaviour.

Make security part of engineering rather than an apology issued after release.

AI has not made basic security obsolete. It has made the absence of basic security indefensible.