As we noted in our April introduction to Claude Mythos, Anthropic’s preview changed the math. The model discovered thousands of zero-day vulnerabilities across every major operating system and browser, reported a 72% exploit success rate, and chained weaknesses together to achieve full exploit. For most General Counsel, the announcement reads like a security headline. It is not. It is a legal defensibility problem, and most legal functions are not yet built for it.
Patch and incident programs calibrated for days-to-weeks exposure windows were already strained. They are no longer reasonable for any high-value enterprise. The window now is hours. Every hour an unpatched crown-jewel system stays exposed is a fact that a regulator, a plaintiff, or a shareholder will eventually question. The job is to make sure the answer holds up.
The legal problem hiding inside the security headline
When a model can find and chain vulnerabilities at scale, the question stops being “did we patch fast enough” and becomes “can we explain, with documentation, why we did what we did, when we did it, and who owned the decision.” That is a legal question, not an engineering one.
Four pressure points sit on the General Counsel’s desk now:
- Contracts. Vendor obligations written for a slower threat model misalign with the risk. Patch SLAs, disclosure timelines, and Software Bill of Materials (SBOM) commitments need to match the speed of what is actually happening.
- Regulatory posture. The gap between what regulators will assume happened and what your timeline can show is widening.
- Incident response timing. Privilege analysis, litigation hold decisions, and notification clocks all start sooner than the playbook assumes.
- Board oversight. Caremark-style scrutiny applies to oversight of cyber risk, and directors will want something more substantive than a quarterly status slide (see In re Caremark Int’l Inc. Deriv. Litig., 698 A.2d 959 (Del. Ch. 1996); Constr. Indus. Laborers’ Pension Fund v. Bingle, 2022 WL 4102492 (Del. Ch. Sept. 6, 2022)).
The connective tissue across all four pressure points is the defensibility narrative. If the timeline does not hold up under examination, the rest of the program does not matter.
Six things the legal function should be doing now
These are the priorities we would push into the next leadership conversation.
1. Make the exposure window a Board KRI. Time-to-triage, time-to-patch, and time-to-verify for crown-jewel systems should be measured and reported up. Treat prolonged exposure as a governance failure, not an IT delay, and have the directors hear it framed that way.
2. Protect privilege from minute one. Update the incident response playbook so technical responders know exactly when and how legal is invoked, how communications are labeled, and what flows through privileged channels. The single most expensive mistake we see in breach response is privilege blown in the first 90 minutes by well-meaning engineers in chat threads.
3. Formalize litigation response for AI-driven incidents. Align breach response, regulatory notification, and litigation hold processes. Document decision ownership, escalation paths, and evidence preservation expectations before the event. After is too late, and the contemporaneous record is what carries weight.
4. Stand up a high-velocity remediation lane for critical assets. Pre-approved emergency change paths, automated regression testing, and rollback for the systems that matter most are critical. Legal should be at the table when the lane is built, not consulted after the first time it gets used.
5. Treat AI integrity as a legal control. A common gap we see: AI agents with write access to logs, records, or audit infrastructure. If the agent can alter the evidence, the evidence is not evidence. Isolate audit infrastructure from agent write access where possible. This is a legal control as much as a technical one.
6. Re-baseline third-party risk for an hours-to-exploit reality. Tighten contractual patch and disclosure SLAs. Clarify rapid escalation rights and SBOM expectations for the vendors who matter most. The TPRM program built for the old timeline is the program that will be litigated against.
The cross-domain point most legal teams miss
The General Counsel sits at the intersection of cyber, privacy, records retention, and third-party risk. Every one of those domains has been quietly building toward the same standard: defensible documentation that holds up when someone with subpoena power asks how a decision was made.
What records retention has known for years, you defend the disposition, not the document, and what TPRM has known for a decade, you defend the diligence, not the vendor, is now the operating principle for cyber response. The General Counsel who can pull these threads into one defensibility narrative will be the one whose program holds when tested.
What to do this quarter
Claude Mythos is a preview of where the threat model is going, not an outlier. Programs designed for a days-to-weeks exposure window will not hold under an hours-to-exploit reality. The legal function does not own the patch cycle. It owns whether the program is defensible when the window closes.
Three actions this quarter:
- Pull the incident response playbook and walk it against an hours-to-exploit fact pattern. Identify every step where privilege, escalation, or evidence preservation breaks. Bring in your cyber insurer early and pre-align with their panel forensic firm so recovery can start immediately.
- Pick the top ten vendors by criticality. Map their patch SLAs, disclosure obligations, and SBOM commitments against current threat reality. Renegotiate the gap.
- Add exposure-window KRIs to the next Board cyber report. Make sure the directors deliberate on this before the first incident forces it.
The work starts now, not after the first hours-to-exploit event lands on your desk.
