What happened
On April 14, 2026, SANS Institute, Cloud Security Alliance (CSA), [un]prompted, and the OWASP GenAI Security Project jointly released 'The AI Vulnerability Storm: Building a Mythos-Ready Security Program' — a free emergency strategy briefing assembled over a single weekend by 60+ contributors and reviewed by 250+ CISOs. The document delivers a 13-item risk register mapped to OWASP LLM Top 10, OWASP Agentic Top 10 2026, MITRE ATLAS, and NIST CSF 2.0, plus an 11-item priority actions table and a board-ready executive briefing section.
Why it matters
The briefing was triggered by Anthropic's Claude Mythos (Preview) autonomously discovering thousands of zero-day vulnerabilities — including a 27-year-old OpenBSD flaw — compressing mean time-to-exploitation from 2.3 years (2019) to under 24 hours (2026). The 13-item risk register provides the most current, practitioner-validated taxonomy of AI-era vulnerability risks available.
Action needed
Download the free briefing and run the 10 CISO diagnostic questions against your current security program this week; use the 11-item priority actions table to identify immediate gaps; present the board-ready section to your next board or audit committee meeting.