When AI Writes the Exploit: Why WAFs Are No Longer Enough

Frontier AI models - most visibly Anthropic's Claude Mythos Preview, announced in April 2026 - can now reportedly autonomously discover thousands of software vulnerabilities, chain them into working exploits, and generate novel attack paths that no human researcher had previously identified. The consequences for application security are direct: defences that depend on recognising attacks that have already been seen are no longer sufficient. 

This brief explains why WAF signatures are not the right primary control in this environment, what attack techniques AI is enabling, and what RedShield’s web application security service does differently - and has been doing for years - to proactively address these risks for our customers.