On June 16, a small group of senior engineering leaders came together at Eataly in downtown Chicago, representing financial services, investment management, and other sectors operating at scale. By the end of the first hour, it was clear we'd landed on a topic nobody wanted to leave.
The central question: what does Claude Mythos actually mean for enterprise security programs? Is this a category shift, or just the latest version of a threat we've been managing for years?
The question that reset the table
We opened with pipeline governance, build vs. buy, AI tooling in delivery. Then someone put the real question on the table: if AI systems can now autonomously discover and exploit vulnerabilities faster than human teams can respond, does your current incident response model still make sense?
The honest answer from most of the room was: probably not. Most security programs were designed around a threat model where humans were on both sides of the exchange. That assumption is eroding quickly.
Guardrails as an engineering problem
The pattern the group kept seeing: guardrails get added after architecture decisions are made, treated as a compliance artifact rather than a design constraint. If agentic systems are making consequential decisions inside your delivery pipeline, what they're allowed to do and how you audit those decisions isn't a post-ship concern. It's a requirements conversation.
Several leaders described the same challenge: teams moving fast on AI adoption, security orgs aware but under-resourced, nobody with clear ownership of the intersection. The governance gap isn't about tooling. It's about accountability.
The part that's actually hard
The conversation kept circling back to speed asymmetry. Autonomous systems at machine speed, against human-run response processes. The organizations getting this right are treating it as an architecture problem, not an escalation problem. Agentic approaches to detection, triage, and response aren't optional at that speed — they're the only path.
The table didn't leave with a clean prescription. What it agreed on: this is a category shift, and most current programs are behind.