👋 Hello Friends,
You’re reading The Tyrex Files, your monthly dose of cybersecurity insights — brought to you by Gérard & Christophe, co-founders of Tyrex US.
These past months are a bit of a special one. Two things happened over the last few weeks that, on the surface, have nothing to do with each other. On one hand, Anthropic dropped Claude Mythos Preview, an AI model that’s been quietly tearing through open-source software finding vulnerabilities at a speed nobody thought possible — including a 27-year-old bug nobody had spotted in OpenBSD. On the other hand, we were at Seatrade Cruise Global in Miami, talking face-to-face with maritime operators about USB security on cruise ships and in ports.
Different worlds, right? Well, not really. The more we thought about it over the last few weeks, the more we realized these two conversations are actually about the same problem — just seen from two ends of the telescope. Mythos accelerates the discovery of software flaws to an unprecedented pace. And industries like maritime, manufacturing, energy — the ones running decades-old OT systems that can’t be patched on a monthly cycle — are exactly the ones who feel that acceleration the hardest. The gap is widening. And the question of how stuff gets into your environment in the first place is more relevant than ever. 🤔
So this month, we’re going to walk you through both. Grab your coffee. ☕
Christophe & Gérard
🚨 Top Cybersecurity Story: Mythos & Project Glasswing — A Watershed Moment
Let’s get straight to the point. On April 7th, 2026, Anthropic publicly unveiled Claude Mythos Preview, and the cybersecurity world has been processing the implications ever since. Here’s the short version:
What Mythos actually did
In its initial weeks of testing, Mythos was unleashed on more than 1,000 open-source software projects, where it surfaced over 23,000 potential vulnerabilities — thousands of which were confirmed as high or critical severity. The headline finds include:
- A 27-year-old latent bug in OpenBSD — a system literally renowned for being “security-focused.” Twenty-seven years of human eyeballs missed it. Mythos didn’t.
- A 16-year-old vulnerability in FFmpeg (the H.264 code everyone uses) — missed by years of professional fuzzing.
- A complete autonomous Remote Code Execution exploit chain on FreeBSD NFS (CVE-2026-4747) — assembled by the model itself for less than $50 of API costs.
- On the Firefox codebase: 181 working exploits — compared to 2 from the previous generation of Claude models.
In other words: vulnerabilities that used to take expert humans weeks or months to find are now being discovered in minutes by an AI, at industrial scale.
Project Glasswing: lock the door before the key gets copied
Anthropic’s response was telling. Instead of releasing Mythos publicly, they locked it behind a controlled coalition called Project Glasswing — currently 12 launch partners including AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, NVIDIA, Palo Alto Networks, and the Linux Foundation, plus around 40 additional organizations. Anthropic also committed $100M in usage credits and $4M in donations to open-source security organizations.
The mission: run Mythos against the world’s critical software, patch what it finds, before a rogue actor builds an equivalent tool. Anthropic estimates a 6- to 18-month lead before that happens. Tick, tick, tick. ⏰
As of the late-May update, 10,000+ high-or-critical severity vulnerabilities had been identified across Glasswing partners. Cloudflare alone got ~2,000 bugs flagged (400 of them critical/high). Mozilla patched 271 Firefox vulnerabilities — a 10x increase over previous AI-assisted reviews. Microsoft is warning that monthly patch waves will keep increasing “for some time.”
👀 Our 2 Cents
Two things really jumped out at us reading through all the coverage:
First — and this one matters to anyone running industrial systems — OT vendors were initially left OUT of Glasswing. American Water and several utilities went public with their frustration, and it’s not hard to see why. While Microsoft, Apple, and Google are sprinting through patches at AI-assisted speed, the operators of water plants, ports, factories, and pipelines didn’t even have access to the model finding bugs in the libraries their systems depend on. The asymmetry is brutal. And it confirms what we’ve been saying for years: OT is the forgotten child of cybersecurity strategy. Until something breaks 🙄. It’s no surprise that at Tyrex US, we’ve been approached more and more by wastewater treatment plants and data center operators about our stations.
Second — and this is the part that fascinated us — the UK AI Safety Institute’s independent evaluation of Mythos noted something fascinating in their report: Mythos failed on their OT-focused cyber range called “Cooling Tower.” Not because it lacked capability, but because it got stuck on the IT sections of the range. The model couldn’t push past the IT/OT gateway. Translation: air-gapping and strict segmentation still work. Even against state-of-the-art offensive AI.
Which, of course, brings us to the obvious follow-up question — if the digital path is blocked, what’s left? And the answer, as it has been for fifteen years since Stuxnet, is the one piece of plastic that bypasses every air-gap ever built: a USB drive. 🔌
Sources:
- Anthropic primary report: red.anthropic.com/2026/mythos-preview
- Project Glasswing initial update: anthropic.com/research/glasswing-initial-update
🤓 Christophe’s Geeking Corner: Air-Gap in the Age of AI — Why Physical Separation Still Wins
Everyone’s been asking me the same question for the last six weeks: “Christophe, if AI can now find 23,000 zero-days in a month, is anything still safe?”
And honestly, my answer is the same as it was three years ago: yes — if it’s air-gapped, you’re in good shape. Let me explain why, with a metaphor my sailing brain can’t help reaching for. ⛵
The lighthouse principle
Imagine your network is a coastline. Mythos and tools like it are the most sophisticated, fastest, most relentless ship that’s ever sailed. It can navigate any open water, dodge any naval defense, and find any unmapped reef.
But here’s the thing about a ship: it cannot sail on land. No matter how advanced its navigation system, no matter how powerful its engines, it physically cannot reach the lighthouse keeper’s cottage three miles inland. The water just stops. And that’s air-gapping. It’s not a clever defense; it’s a categorical one. You’re not playing the same game.
Why this matters more, not less, in the AI era
The instinct after Mythos was to assume “AI changes everything.” Wrong instinct. Mythos changes the speed at which networked vulnerabilities are discovered. It doesn’t change physics. A system that has no network connection cannot be reached by a remote exploit — and no AI in 2026 will alter that.
The UK AI Safety Institute basically proved this point when they tested Mythos against their OT cyber range. The model couldn’t cross the IT/OT gateway. It got stuck at the segmentation boundary. Even Mythos, the most capable offensive cyber AI ever built, hit the wall.
But — and this is the part that should make you sit up straight if you run an OT environment — a wall has doors. ⚠️
The air-gap’s only weakness has a name
Stuxnet taught us this in 2010. PlugX confirmed it in 2024. Honeywell’s industrial threat reports confirm it every single year. USB drives are the universal bypass of air-gapping. That’s their whole job, technically: to move data across a boundary that nothing else can cross. Maintenance technicians, contractors, software updates, electronic chart updates on ships, firmware patches on PLCs — all of it travels by USB.
So here’s the playbook for the post-Mythos era, and it’s actually pretty simple:
- Keep your air-gap. It works. Mythos itself confirms it.
- Assume USB is the threat vector. Because every attacker who can’t get in remotely will reach for it.
- Decontaminate everything that touches the boundary. No exceptions. No “this one is from a trusted vendor.” Stuxnet was from a trusted vendor.
That’s it. That’s the whole strategy. The fancy AI threat doesn’t change the fundamentals — it just makes the fundamentals more urgent. 🛡️
Stay vigilant, friends. And keep those USBs clean.
📰 Gérard’s Cybersecurity Spotlight: The 2026 CISO Report
Instead of my usual roundup of headlines, this month I want to point you toward a single document that I think every cybersecurity professional — and especially every business leader who thinks about cybersecurity — should read this quarter: the 2026 CISO Report, published in March by Cybersecurity Ventures in partnership with Sophos.
It’s a snapshot of where the CISO role stands today, and frankly, the picture it paints is sobering. A few things in particular jumped out at me, and they connect directly to what we’ve been talking about this month with Mythos.
The numbers that stopped me cold:
- 35,000 CISOs in the entire world. 359 million businesses. That’s a 10,000-to-1 ratio. As Sophos CEO Joe Levy puts it in the report, “this is a market failure.” Most small and mid-sized businesses don’t have — and cannot afford — a CISO. And yet they’re prime targets.
- Average CISO tenure is now between 18 and 26 months. Think about that. The person responsible for protecting your business changes every two years. Continuity of strategy in cybersecurity? Good luck.
- 75% of CISOs are interested in a job change. One-third say stress is adversely affecting their performance. 99% work overtime every week. One in five works an extra 25 hours per week. Burnout isn’t a future risk; it’s the current operating reality.
- 96% of CISOs are already using AI to enhance their cybersecurity posture. AI is no longer “emerging” — it’s table stakes. Which, when you read this report next to the Anthropic Mythos news from this month, gives you a pretty clear picture of where 2026 is heading.
- Supply chain attacks: 30% of all breaches in 2025, double the previous year. Predicted to cost the world $138 billion by 2031. Read that twice.
- 70-90% of breaches still come from human error or social engineering. The fanciest AI defense in the world won’t help if Bob in accounting plugs in the wrong USB. (Yes, I know, I’m a broken record on this.)
👀 Our 2 Cents
What this report makes painfully clear is that the people on the front line — the CISOs — are outnumbered, outpaced, and outgunned. They’re managing supply chain risk, AI infrastructure security, ransomware, quantum readiness, insider threats, and regulatory pressure — often simultaneously, often on inadequate budgets (only 29% of CISOs in Splunk’s survey said their budget was adequate), and often without an internal successor in place.
Which is why fundamentals matter more than ever. You can’t out-staff this problem. You can’t out-spend it. What you can do is reduce your attack surface by controlling the things you actually control — like the USB drives walking through your front door every day. That’s not a silver bullet. There is no silver bullet. But it’s one fewer thing for an exhausted CISO to lose sleep over. 😴
📄 Read the full report: 2026 CISO Report — Cybersecurity Ventures & Sophos
🌟 Cybersecurity Experts to Follow This Month
- Logan Graham (🇺🇸 / 🇬🇧) — Head of Frontier Red Team at Anthropic, and one of the public faces of the Mythos research. If you want to understand what’s coming next from offensive AI capabilities directly from the people building (and stress-testing) it, his posts and interviews around the Glasswing launch are essential reading. Find him on LinkedIn and X.
- Robert M. Lee (🇺🇸) — Founder & CEO of Dragos, one of the world’s leading OT/ICS cybersecurity firms. Lee has been one of the loudest voices reminding the industry that “AI changes the IT threat landscape, but OT plays by different rules.” Particularly relevant given the Glasswing OT-exclusion debate. X / @RobertMLee — LinkedIn.
- Vincent Strubel (🇫🇷) — Current Director General of ANSSI (France’s national cybersecurity agency, and arguably the most respected government cyber body in Europe). Strubel has been speaking publicly about AI-enabled threats to critical infrastructure throughout 2026, and France was instrumental in last year’s PlugX international takedown — so the French OT cyber perspective continues to punch above its weight. LinkedIn.
💥 USBs Gone Wild: Port of Call — A Post-Mythos Maritime Scenario
The Context: A major cruise ship terminal on the US East Coast — let’s call it “Port Meridian” — handles 40+ port calls per week during high season. Each ship that docks brings with it a small army of contractors, supply vendors, and crew handing over USB drives full of electronic chart updates (ENCs), engine telemetry, manifest data, propulsion system patches, and entertainment system content. Multiply that by every cruise line, freight operator, and bunker supplier, and you have thousands of USB devices crossing the IT/OT boundary every single week — into systems controlling everything from ship navigation to terminal logistics to bunkering operations.
The Setup: In our scenario, a sophisticated threat actor — let’s say a financially-motivated group with state-aligned tooling — gets hold of a Mythos-equivalent AI model (because remember, Anthropic estimates a 6-18 month window before peer labs catch up). They use it to systematically scan the firmware and embedded software of common maritime equipment: ECDIS (Electronic Chart Display and Information Systems), ballast water management controllers, bunkering automation, and the SCADA systems running port cranes.
Within days, the AI surfaces a previously unknown vulnerability — a memory corruption flaw in a popular ECDIS firmware library used by dozens of vessel classes. A 12-year-old bug. Patchable, in theory. Except no shipping operator on Earth runs monthly patch cycles on production ECDIS units. The fleet-wide update window is measured in years, not days.
The Attack Vector: The attackers weaponize the zero-day into a payload that fits comfortably on a 16GB USB stick disguised as an electronic chart update from a real, well-known marine cartography vendor. Through social engineering — a fake but very convincing email to a port pilot, with a USB drive delivered by courier to the harbor master’s office — the device enters the terminal. The harbor master, working under a tight tide window, plugs it into the operations workstation to verify the chart pack before handing it off to inbound vessels.
That’s all it takes.
The Cascade:
- The compromised workstation now serves as the staging point. The USB exploit drops a custom payload designed to propagate via subsequent USB drives — every device plugged into that machine becomes a carrier.
- Within 72 hours, the malware has traveled aboard at least four vessels, where it lies dormant inside ECDIS systems waiting for a trigger condition (specific GPS coordinates, a specific date range, or a remote signal via the ship’s satellite link).
- Meanwhile, on the port-side network, the malware moves laterally into the bunkering automation system and the crane SCADA controllers. It begins exfiltrating operational data — vessel schedules, fuel quantities, cargo manifests — preparing for either ransom, sale, or sabotage.
- Detection comes weeks later, when an unrelated audit flags anomalies in bunker meter readings. By then, the operational and financial damage runs into millions, port operations are partially suspended for forensics, and several shipping lines have to recall and quarantine entire ECDIS fleets.
How Tyrex Would Have Changed the Story:
This is, frankly, the textbook scenario our TYREX TOTEM and SATELLITE kiosks are built for:
- Every USB entering the harbor master’s office or vessel cyber-perimeter goes through the kiosk first. No exception, no “trusted vendor” override.
- The kiosk’s multi-engine antivirus and behavioral analysis flags the disguised executable and the suspicious firmware-level activity — even if the specific zero-day signature is unknown, the behavior (a chart pack trying to execute code, modify boot sectors, or replicate to other media) trips the heuristic engines.
- The infected drive is quarantined at the boundary. Logs are pushed in real-time to the central TYREX Management server. The harbor master and port CISO are alerted within seconds.
- Once a single sample is identified, the threat signature propagates across the kiosk fleet. Every other Tyrex station in the port now blocks the same payload, automatically.
The ECDIS vulnerability still exists. The Mythos-discovered zero-day is still real. But it never reaches the systems that matter — because the physical entry point was monitored.
The Lesson: This is exactly the conversation we had over and over again with operators at Seatrade Cruise Global in Miami last month. The maritime industry runs on air-gapped systems that cannot patch fast enough to match AI-accelerated threat discovery. The defense isn’t faster patching — that race is already lost. The defense is controlling what crosses the gap in the first place. USBs in. USBs out. Every single one. Every single time.
📝 We dove deeper into the specific cyber risks facing cruise lines and maritime operators in a recent article on the Tyrex blog. Worth a read if your operation has anything to do with ports, vessels, or the supply chains that keep them moving.
📞 Take Action!
Mythos is a wake-up call. But it’s also a clarification: the fundamentals haven’t changed. Air-gap your critical systems. Control what crosses the boundary. Decontaminate every USB.
Want to talk through what an AI-accelerated threat landscape means for your specific environment — maritime, manufacturing, energy, defense, or otherwise?
👉 Let’s schedule a call!— no slides, no sales pitch, just a real conversation about where USB security fits in your strategy.
Don’t let a simple USB drive become your most expensive lesson. 🛡️
Powered by Tyrex USA. Our mission: protect organizations worldwide from the rapidly evolving cyber threats hiding inside USB drives and other removable media.
