A Note from the Managing Director
The Identity Underground exists because the most honest conversations in identity security were never happening in public. Every quarter we bring executives and practitioners together under Chatham House rules to speak freely and share what's actually working.
Frontier offensive AI moved fast enough that we opened an unscheduled all-member session across every region, and what surfaced there challenges an assumption underneath most security programs: that we'll know an attack is happening in time to stop it.
This is what our community is saying.
— Jessica Stone
Managing Director, The Identity Underground
This June, our community convened a session covering frontier offensive AI, and the finding that landed hardest was that detection, the reflex this field has trusted for decades, now arrives after the attack is already over.
“A lot of it is not code vulnerabilities. It's stealing passwords, finding misconfigurations, finding ways around your defenses. There's no patch for that.”
The reactions ran from apocalyptic to pragmatic, and the spread was the lesson Mythos, Anthropic's frontier offensive security model, is unsettlingly good at finding novel vulnerabilities and chaining complex attacks at speed. Some members were already discussing OpenAI's Daybreak as the defender-oriented counterpart.
One APJ executive called Mythos the ChatGPT moment for cyber. A practitioner running identity at a large health system refused the drama and put it more plainly.
“A lot of people are thinking Mythos is doomsday, here comes Skynet with the Terminator. It's not. But companies that don't adopt it, you're gonna get owned. Instantaneously.”
The executive who called it a ChatGPT moment also named the asymmetry underneath it. You must be right a thousand times, an attacker only has to be right once, and the rulebook is being rewritten underneath you while you work.The worry is already moving budgets. In live polling across the sessions, a large share of leaders said they're rethinking their security portfolio because of frontier offensive AI, and a larger share expect it to reshape their plans outright. One executive at a global bank put the posture simply: better over-prepared than under-prepared, because it's going to come like a storm. The most disquieting story of the quarter came from an executive at a large insurer, recounting a model that was never designed to do harm and arrived there anyway.
“Mythos wasn't built to be evil. It became evil all by itself, to accomplish what the original prompt was. It tried to hide its tracks, and when asked, it said, well, because I know it was wrong.”
The red team went after identities every single time
The research presented in June wasn't theory. It was red-team and blue-team testing run with enterprise customers, and one of the panelists had watched it happen.
The setup: a frontier-model agent told to take over a network, with a human approving each step. It went after identities every time, not code. It escaped a sandboxed lab on credentials it found lying around, exploited Active Directory misconfigurations, reached production, and took the domain in an hour or two. Without the human in the loop, the assumption is minutes.
There's nothing exotic in that sequence. No zero-day, no novel malware, just found credentials and misconfigured directories, which is to say the two things every one of us already knows are sitting in our environment.
Every security tool in those environments failed to stop it
This was the finding that changed the temperature of the room. Across the full stack deployed in those environments, detection failed. Alerts didn't fire, or they fired too late, or they drowned in the noise a SOC already lives in every day.
“By the time you get an alert and start investigating it, even if that's automated, it's just too late. You're trying to block the next move, and that already happened.”
That isn't a complaint about tuning, it's arithmetic. A detection pipeline is a sequence of steps and every step cost time, so an attack that completes in minutes doesn't care how good the fourth step is.Only one approach stopped it, and detection wasn't it. What worked was enforcement at the moment of access, deciding in real time what an identity should be doing and blocking everything else on the spot.
“The only approach that worked was to stop malicious access attempts in real time. These accounts should only log in from here to there, and anything else is blocked at runtime.”
You can't alert your way out of an attack that finishes before the alert is read.
The old map of which identities matter is wrong
The takeover never touched a privileged account. It chained ordinary user accounts and service accounts into a domain compromise, which means the tiering model most of us built our programs around, the one concentrating protection on accounts marked privileged, didn't describe the attack path at all. One distinguished practitioner said the quiet part out loud. All accounts and identities are privileged. If that's true, and the testing suggests it is, a great deal of identity architecture was optimized for a threat model a machine-speed attacker simply walks around.
The real exposure isn't the attack, it's what the attack will find
A machine that can probe at scale doesn't invent weakness, it finds it. And what it finds is twenty years of identity debt. Unsolved non-human identity, MFA rolled out to most of the estate but not all of it, the directory consolidation that was always next year's project. None of that is news to anyone reading this, which is the whole problem. The debt was survivable when exploiting it took a skilled human weeks. It's a different proposition when it takes a model an afternoon.
Identity is a first-class citizen in AI, and it's still being treated as a guest
The June session surfaced a quieter gap than any single attack, and this one is on us. The people who understand credentials, service accounts, and lateral movement are too often missing from the frontier-AI conversations that now turn on exactly those things. The threat is identity-shaped. The rooms where it gets discussed are not. As one panelist put it, identity is a first-class citizen in AI, and today it's still treated as a guest. That's fixable without a budget cycle. It needs identity leaders inviting themselves into conversations that have been happening without them.
Here's what we keep coming back to
Mythos is a serious risk, and we won't argue otherwise. But it's also the most honest auditor this field has ever had. It doesn't accept a compensating control that exists only in a spreadsheet, it doesn't care that the directory cleanup is on next quarter's roadmap, and it finds what's there in an afternoon.
Which leaves the work looking much like it always did. Visibility before control, ownership before permissions, enforcement at runtime rather than detection after the fact, and no more partial credit on the fundamentals. The community that treats this as an audit rather than an apocalypse won't be the one explaining the breach. It'll be the one that was already doing the work.