# Ai vulnerability šŸ’© storm.. is a coming **URL:** \ **Category:** Off Topic\ **Created:** [April 23, 2026, 2:18pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328 "2026-04-23T14:18:42Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![josecgomez](https://www.epiusers.help/user_avatar/www.epiusers.help/josecgomez/32/55731_2.png) [@josecgomez](https://www.epiusers.help/u/josecgomez)\ **Post date:** [April 23, 2026, 2:18pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/1 "2026-04-23T14:18:42Z")
Just shared this CSA / SANS paper with our exec team and wanted to get thoughts from this group as well. > **[Lab Space](https://labs.cloudsecurityalliance.org/mythos-ciso/)** > > The landing page for agile CSA community projects This was put together by a pretty credible group. CSA CISO community, SANS, OWASP GenAI, along with current and former CISOs from places like Google and Cloudflare. Not vendor fluff, no ā€œAiā€ hype to sell software. The core argument is simple but important: The time between vulnerability discovery and exploitation is collapsing. Not days or weeks anymore. In some cases hours. That changes how you think about patching, response, and overall risk. And it is not just speed. It is volume and accessibility. AI is making it easier to find real vulnerabilities at scale, which means more pressure on already stretched teams. A few things that stood out to me: - We are going to see a lot more vulnerabilities, and more of them will be valid - Attackers are getting more benefit from AI than defenders right now - The idea that we have time to react is starting to break down - You cannot scale this problem with people alone. You HAVE TO use models to write defensive code or you will get overun. One area I keep coming back to, especially in the Epicor world, is control over the environment. If this plays out the way they are describing, then: - Shadow IT becomes a bigger problem, not a smaller one - Random SaaS tools spinning up outside of IT just increase exposure - The more fragmented the environment is, the harder it is to respond at speed We have been tightening this up internally. No system gets introduced without IT involvement. Period. SaaS included. It is not about slowing the business down, it is about making sure we can actually secure and support what gets deployed. Also worth calling out, they specifically mention burnout as a real risk. The volume and pace they are describing is not something most teams can absorb without changes in tooling, process, or staffing. Are you changing anything yet in how you handle patching, vendors, or shadow IT? Or does this still feel a bit early? Is SaaS a better proposition because of this or is it worse? Do we trust the vendors (Epicor and others) to keep up with this? I am torn, on one side shifting the responsibility to Epicor sounds great, but (no ofense to them) we have seen them drop the ball fairly often in SaaS land. Also there is near ZERO need to have your ERP Web accessible in the WAN thatā€™s just a huge attack surface that is the point? Wouldnt the ERP be a lot more secure if it was limited to the inner sanctum of your network? We live in damn interesting timesā€¦ hereā€™s a :dumpster_fire: not specifically tied to Epicor, but tied to the damn IT work we are about to walk intoā€¦ FML ---
**Author:** ![josecgomez](https://www.epiusers.help/user_avatar/www.epiusers.help/josecgomez/32/55731_2.png) [@josecgomez](https://www.epiusers.help/u/josecgomez)\ **Post date:** [April 23, 2026, 2:20pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/2 "2026-04-23T14:20:31Z")
It also basically means we shouldnā€™t be writing code manually any more, at least not without some serious workflows for review that include Model Driven vulnarability analysis. We simply arenā€™t ā€œsmart enoughā€ (speed, and knowledge) to fight this individually. ---
**Author:** ![Chris\_Conn](https://www.epiusers.help/user_avatar/www.epiusers.help/chris_conn/32/93797_2.png) [@Chris\_Conn](https://www.epiusers.help/u/Chris_Conn)\ **Post date:** [April 23, 2026, 2:34pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/3 "2026-04-23T14:34:18Z")
_Anthropic Mythos enters the chat_ ---
**Author:** ![GabeFranco](https://www.epiusers.help/user_avatar/www.epiusers.help/gabefranco/32/80642_2.png) [@GabeFranco](https://www.epiusers.help/u/GabeFranco)\ **Post date:** [April 23, 2026, 2:37pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/4 "2026-04-23T14:37:28Z")
As someone who was always a fan of the concept of the singularity since first reading of the concept in the 1990s, we are firmly here. This type of paradigm shift in the status quo will occur to many industries, departments, etc. - security is just one of the more low hanging fruit for AI because itā€™s all patterns and to date mostly handled by obscurity. Automated repo based code reviews (see Google jules) are the way ---
**Author:** ![chaddb](https://www.epiusers.help/user_avatar/www.epiusers.help/chaddb/32/89855_2.png) [@chaddb](https://www.epiusers.help/u/chaddb)\ **Post date:** [April 23, 2026, 2:46pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/5 "2026-04-23T14:46:40Z")
> [@josecgomez](#): > > Is SaaS a better proposition because of this or is it worse? Do we trust the vendors (Epicor and others) to keep up with this? I donā€™t trust any SaaS vendor more than myself. Daily there are security breaches and data exfiltration stories. ---
**Author:** ![Mark\_Wonsil](https://www.epiusers.help/user_avatar/www.epiusers.help/mark_wonsil/32/51594_2.png) [@Mark\_Wonsil](https://www.epiusers.help/u/Mark_Wonsil)\ **Post date:** [April 23, 2026, 2:53pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/6 "2026-04-23T14:53:30Z")
> [@josecgomez](#): > > FML Sorry, which markup language is this? ![Think Matthew Mcconaughey GIF by First We Feast](https://media4.giphy.com/media/v1.Y2lkPWU5MGVkYmEzeXdlMHIzNG5qdWN5NTlqbHVsbjJlZnRlM3drcDhiYzJpNWhhaXM4OCZlcD12MV9naWZzX3NlYXJjaCZjdD1n/6tip1JMRXM8YIsylt7/giphy.webp) ---
**Author:** ![zachg](https://www.epiusers.help/user_avatar/www.epiusers.help/zachg/32/89129_2.png) [@zachg](https://www.epiusers.help/u/zachg)\ **Post date:** [April 23, 2026, 2:55pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/7 "2026-04-23T14:55:08Z")
> [@Chris\_Conn](#): > > Anthropic Mythos enters the chat Mythos is finding vulnerabilities, that much is clear. It is also possible for models since GPT-5.3-Codex to do very similar work as the vulnerabilities Anthropic announced with Mythos were also found by GPT and other models. Weā€™ve been in this position for months, one headline just got more people looking at the emerging problem. An argument can now be made that SaaS introduces more surfaces, which in turn is less secure. Internalizing everything may occur, given the SaaS market is already down every time a new model releases. Take a look at $FIG or the index in general over these companies. Down. I think, whether itā€™s accepted or not, to youā€™re point: you HAVE to use these models. Side note: Be careful with defensive code prompts, AI will overload them into performance critical hot paths. Side note 2: OpenAI is claiming to release a similar quality of model to Mythos today. ---
**Author:** ![MarkBetts](https://www.epiusers.help/letter_avatar_proxy/v4/letter/m/e47c2d/32.png) [@MarkBetts](https://www.epiusers.help/u/MarkBetts)\ **Post date:** [April 23, 2026, 2:56pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/8 "2026-04-23T14:56:48Z")
Thanks for sharing. ---
**Author:** ![Mark\_Wonsil](https://www.epiusers.help/user_avatar/www.epiusers.help/mark_wonsil/32/51594_2.png) [@Mark\_Wonsil](https://www.epiusers.help/u/Mark_Wonsil)\ **Post date:** [April 23, 2026, 3:06pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/9 "2026-04-23T15:06:29Z")
> [@zachg](#): > > Mythos is finding vulnerabilities, that much is clear. Finding vulnerabilities is one thing, but these models are also creating working exploits. The model doesnā€™t really matter, and I think the authors of the paper above even say so. Itā€™s the existence of this capability that is the cause for concern. The question is, do you play wack-a-mole trying to fix every security flaw or do you design systems that expect to be exploited and handle the behavior. In civil engineering it would be equivalent to ā€œbend, donā€™t break.ā€ ---
**Author:** ![josecgomez](https://www.epiusers.help/user_avatar/www.epiusers.help/josecgomez/32/55731_2.png) [@josecgomez](https://www.epiusers.help/u/josecgomez)\ **Post date:** [April 23, 2026, 3:08pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/10 "2026-04-23T15:08:06Z")
> [@Mark\_Wonsil](#): > > which markup language is this? a ā€œFrequently used oneā€ one šŸ˜‰ FML (frequent markup language) as inā€¦ I use it oftenā€¦ to ā€¦ ā€œremarkā€ and ā€œempahsizeā€ howā€¦ Fā€¦cked we are šŸ¤£ ---
**Author:** ![JasonMcD](https://www.epiusers.help/user_avatar/www.epiusers.help/jasonmcd/32/22326_2.png) [@JasonMcD](https://www.epiusers.help/u/JasonMcD)\ **Post date:** [April 23, 2026, 3:08pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/11 "2026-04-23T15:08:10Z")
> [@josecgomez](#): > > Also there is near ZERO need to have your ERP Web accessible in the WAN thatā€™s just a huge attack surface that is the point? Is my bank account any safer? Iā€™m not sure if I want an answer to that. ---
**Author:** ![josecgomez](https://www.epiusers.help/user_avatar/www.epiusers.help/josecgomez/32/55731_2.png) [@josecgomez](https://www.epiusers.help/u/josecgomez)\ **Post date:** [April 23, 2026, 3:09pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/12 "2026-04-23T15:09:04Z")
> [@JasonMcD](#): > > Is my bank account any safer? Most banks run COBOL 85 soā€¦ technically yesā€¦ but only by virtue of obsellesense Also they have FDIC to insure you so your personal risk is minimal. Can you/we say the same about your/our systrems? šŸ¤” ---
**Author:** ![zachg](https://www.epiusers.help/user_avatar/www.epiusers.help/zachg/32/89129_2.png) [@zachg](https://www.epiusers.help/u/zachg)\ **Post date:** [April 23, 2026, 3:09pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/13 "2026-04-23T15:09:23Z")
Whack-a-mole is exactly what the companies with Mythos are doing, including Microsoft. They fixed over 100 vulnerabilities in Windows alone. So, yes. ---
**Author:** ![josecgomez](https://www.epiusers.help/user_avatar/www.epiusers.help/josecgomez/32/55731_2.png) [@josecgomez](https://www.epiusers.help/u/josecgomez)\ **Post date:** [April 23, 2026, 3:20pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/14 "2026-04-23T15:20:34Z")
Also Banks Systems were written with security a the forefront. They know they had a huge attack surface so most if not all planned for it and around it. They are hardened first , secure first systems. ERP Security has (for the most part) always been a second if not third class citizien. Look at Epicor for example, Menu security (UI) security is the default. You can block acces to Order Entry via menu security while the same user using REST can use 100% ofm the functionality of the Sales Order Business Object. We (all of us including the ERP) need to re-evaluate our software security stance. ---
**Author:** ![JasonMcD](https://www.epiusers.help/user_avatar/www.epiusers.help/jasonmcd/32/22326_2.png) [@JasonMcD](https://www.epiusers.help/u/JasonMcD)\ **Post date:** [April 23, 2026, 3:21pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/15 "2026-04-23T15:21:50Z")
I guess I mean a more fundamental level - not just wipe my account, but remove the field that stores my current balance and the transactions to support it. And all the backup database records, too. Iā€™m not mocking your point; Iā€™m saying thereā€™s no real end to this road and thatā€™s always scared me. Iā€™ve never really understood security; canā€™t it always be reverse engineered at some point? 2FA seems great until I think about how I need A. A password B. And a code sent to my phone But if I forget A, then the solution is toā€¦ send a code to my phoneā€¦ so if A=B and B=B then 2FA is just 2B: my phone X2. > [@josecgomez](#): > > You can block acces to Order Entry via menu security while the same user using REST can use 100% ofm the functionality of the Sales Order Business Object. Definitely. And API v2 is not enforced (right?) You can go on for a while. ---
**Author:** ![JasonMcD](https://www.epiusers.help/user_avatar/www.epiusers.help/jasonmcd/32/22326_2.png) [@JasonMcD](https://www.epiusers.help/u/JasonMcD)\ **Post date:** [April 23, 2026, 3:23pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/16 "2026-04-23T15:23:17Z")
I need to learn how to farm. ---
**Author:** ![chaddb](https://www.epiusers.help/user_avatar/www.epiusers.help/chaddb/32/89855_2.png) [@chaddb](https://www.epiusers.help/u/chaddb)\ **Post date:** [April 23, 2026, 3:25pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/17 "2026-04-23T15:25:05Z")
> [@JasonMcD](#): > > 2FA seems great until I think about how I need > A. A password > B. And a code sent to my phone Donā€™t rely on SMS MFA. Itā€™s barely MFA. Itā€™s better than nothing in some cases. And is usually the only option with banks. But something like a Yubikey or even TOTP canā€™t be sent to another phone. If they have your password **and** your phone/Yubikey you are are rally Fā€¦cked ---
**Author:** ![josecgomez](https://www.epiusers.help/user_avatar/www.epiusers.help/josecgomez/32/55731_2.png) [@josecgomez](https://www.epiusers.help/u/josecgomez)\ **Post date:** [April 23, 2026, 3:25pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/18 "2026-04-23T15:25:31Z")
This sounds more and more appealing every day. This job has turned into a nightmare since the LLM revolution. Even when you embrace it the changing field at break neck speed is killing me (us). I yearn for the days of I learned PHP and Iā€™m good with that guy for 10 years. Now you use one Ai tool today adn thereā€™s a better new one tomorrow. Its exhausting, that paper talks about Burn out and boy oh boy isnā€™t that 100% true right now. Lets estabolish a comune of non internet connected village that runs Epicor classic in our walled guarden and live off bartering šŸ¤£ ---
**Author:** ![utaylor](https://www.epiusers.help/user_avatar/www.epiusers.help/utaylor/32/64664_2.png) [@utaylor](https://www.epiusers.help/u/utaylor)\ **Post date:** [April 23, 2026, 3:25pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/19 "2026-04-23T15:25:46Z")
I have been having this internal dialogue with myself for months now, Iā€™ve researched how CTOā€™s CIOā€™s are handling the deployment of systems, are they really filtering it all through the department first or are they allowing departments to choose their own systems/tooling. Wild times for sure man. ---
**Author:** ![chaddb](https://www.epiusers.help/user_avatar/www.epiusers.help/chaddb/32/89855_2.png) [@chaddb](https://www.epiusers.help/u/chaddb)\ **Post date:** [April 23, 2026, 3:26pm UTC](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328/20 "2026-04-23T15:26:37Z")
> [@josecgomez](#): > > Lets estabolish a comune of non internet connected village that runs Epicor classic in our walled guarden and live off bartering šŸ¤£ ![Season 5 Yes GIF by Paramount+](https://media4.giphy.com/media/v1.Y2lkPWU5MGVkYmEzcGg0b3B2N2k1dGFqMDc5bG9scjBmYmV0N3g5eGN3djFqemR4ZG1jNiZlcD12MV9naWZzX3NlYXJjaCZjdD1n/mGDvFv4tWxzZcw4Bn6/giphy.webp) [Next page](https://www.epiusers.help/t/ai-vulnerability-storm-is-a-coming/134328.md?page=2)