Anthropic’s Claude Mythos AI Model Preview: The Locked-Down Weapon Reshaping Cybersecurity in 2026 | NeuralWired
This analysis is published by NeuralWired, frontier intelligence for the professionals who build, fund, and govern technology’s future. For related coverage, see our AI Safety and Cybersecurity verticals.
AI Security
Anthropic’s Claude Mythos AI Model Preview: The Locked-Down Weapon Reshaping Cybersecurity in 2026
The most powerful AI model Anthropic has ever built can find zero-days in every major OS. You can’t have it. Here’s why that decision might be the most consequential thing in enterprise security this year.
Published: April 8, 2026Category: AI Security / Frontier ModelsRead time: 14 minutes
Anthropic’s Claude Mythos AI model preview can find a 27-year-old vulnerability in OpenBSD, a 16-year-old exploit in FFmpeg that had survived five million automated scans without detection, and a multi-flaw chain in the Linux kernel. It can do all of this autonomously. And you cannot have access to it.
That restriction is deliberate. Anthropic announced on April 7, 2026 that Claude Mythos Preview was its most powerful model yet, outperforming every earlier Claude iteration on coding, reasoning, and cybersecurity benchmarks by margins that security practitioners are calling a generational leap. The company simultaneously announced that it would not be releasing the model publicly.
Instead, Mythos has been reserved for a closed network of 11 founding partners and over 40 additional vetted organizations under a new initiative called Project Glasswing. The logic is straightforward and the stakes are extraordinary: a model this capable in the hands of the wrong actor could automate exploitation of critical infrastructure at a scale and speed that no human security team could outrun.
This analysis breaks down what Mythos actually is, what the benchmarks reveal, how Project Glasswing is structured, who already has access, and what every CISO, CTO, and security engineer needs to do before the end of 2026 regardless of whether they ever get near the model.
What is the Anthropic Mythos AI Model Preview?
Claude Mythos Preview is Anthropic’s description of it as “the most powerful AI model we’ve ever developed.” It supersedes Claude Opus 4.6 as Anthropic’s flagship frontier model and was developed with a specific focus on advanced code reasoning, agentic workflows, and cybersecurity vulnerability discovery.
The model operates autonomously across multi-step technical tasks. It can be given a codebase, binaries, or a system specification and it will scan for weaknesses, generate exploit proof-of-concept code, and propose patches without requiring a human to guide each step. That level of agentic capability distinguishes Mythos from earlier language models that could discuss security topics but could not execute against them.
Anthropic first began using Mythos internally in large-scale vulnerability hunts before the April announcement. The results were significant enough to warrant both a formal partner program and a decision not to release the model to the public. According to the Project Glasswing announcement, Mythos has already identified thousands of high-severity vulnerabilities across every major operating system and web browser. Those findings have been reported to software maintainers in a coordinated disclosure process.
The model carries an internal codename of “Capybara” according to community tracking, and details about its architecture first became public in March 2026 through a content management system misconfiguration that exposed pre-release documentation. The official announcement in April aligned with that leaked framing.
“AI capabilities have crossed a threshold that fundamentally changes the urgency required to protect critical infrastructure from cyber threats, and there is no going back.”
Anthony Grieco, SVP and Chief Security and Trust Officer, Cisco
Benchmark Dominance: The Numbers Behind the Hype
Vendor benchmark claims deserve scrutiny, and Anthropic’s case for Mythos rests on a suite of evaluations that covers coding, cybersecurity, general reasoning, and agentic task performance. The numbers, drawn from Anthropic’s Glasswing announcement and confirmed by the Mythos system card summary at NxCode, represent double-digit gains over the previous flagship in most categories.
Benchmark
Mythos Preview
Claude Opus 4.6
Delta
CyberGym (vulnerability reproduction)
83.1%
66.6%
+16.5 pts
SWE-bench Verified
93.9%
80.8%
+13.1 pts
SWE-bench Pro
77.8%
53.4%
+24.4 pts
Terminal-Bench 2.0
82.0%
65.4%
+16.6 pts
SWE-bench Multimodal
59.0%
27.1%
+31.9 pts
GPQA Diamond
94.6%
91.3%
+3.3 pts
Humanity’s Last Exam (no tools)
56.8%
40.0%
+16.8 pts
USAMO 2026
97.6%
N/A
New benchmark
BrowseComp (4.9x fewer tokens)
86.9%
83.7%
+3.2 pts
OSWorld-Verified
79.6%
72.7%
+6.9 pts
The most striking figures are in the coding categories. The 31-point lead on SWE-bench Multimodal and the 24-point jump on SWE-bench Pro reflect Mythos’s capacity to understand and act on code at a level that earlier models could approximate but not reliably execute. SWE-bench Pro targets professional-grade software engineering tasks, which maps more directly to real security work than sanitized benchmark conditions.
The CyberGym score deserves attention specifically because it measures vulnerability reproduction rather than theoretical knowledge. A score of 83.1% means that in four out of every five cases, Mythos was able to independently reproduce a known vulnerability from minimal starting information. At Opus 4.6’s 66.6%, that figure was already impressive for an AI system. The Mythos gap represents a fundamentally different operational posture.
“The window between a vulnerability being discovered and being exploited by an adversary has collapsed. What once took months now happens in minutes with AI.”
Elia Zaitsev, Chief Technology Officer, CrowdStrike
These benchmarks were run by Anthropic on its own infrastructure, which means independent replication has not yet occurred. That is a legitimate methodological caveat. But the case studies accompanying the Glasswing announcement, including the 27-year OpenBSD bug and the 16-year FFmpeg vulnerability, provide concrete evidence beyond benchmark scores. The FFmpeg flaw in particular had survived five million automated scans by existing tools without being flagged.
Project Glasswing and the Partner Coalition
Project Glasswing is the governance structure Anthropic built around Mythos to enable defensive use while limiting offensive exposure. Named after a transparent-winged butterfly, it functions as a vetted-access program that grants qualifying organizations the ability to run Mythos against their own codebases and infrastructure.
The 11 founding partners represent a cross-section of the technology and critical infrastructure landscape:
Amazon Web ServicesAppleBroadcomCiscoCrowdStrikeGoogleJPMorganChaseLinux FoundationMicrosoftNVIDIAPalo Alto Networks
Beyond those 11, more than 40 additional organizations that build or maintain critical software have received access for scanning their own first-party and open-source code. Anthropic has also committed up to $100 million in Mythos usage credits for Glasswing participants and $4 million in direct financial support to open-source security organizations, including $2.5 million to Alpha-Omega and the OpenSSF through the Linux Foundation, and $1.5 million to the Apache Software Foundation.
Partners can access Mythos through four channels: the Claude API directly, Google Cloud Vertex AI, Amazon Bedrock, and Microsoft Azure Foundry. After the credit period ends, pricing is set at $25 per million input tokens and $125 per million output tokens. Anthropic has committed to publishing a formal progress report within 90 days, covering vulnerabilities fixed and security improvements that can be publicly disclosed.
“By giving maintainers of critical open-source codebases access to a new generation of AI models that can proactively identify and fix vulnerabilities at scale, Project Glasswing offers a credible path to changing that equation.”
Jim Zemlin, CEO, The Linux Foundation
Why Anthropic Is Keeping Mythos Locked Down
The decision not to release Mythos publicly is not primarily a product strategy. It reflects a specific risk calculation that Anthropic describes explicitly in the Glasswing documentation: a model this capable at finding and exploiting software vulnerabilities is also a model that attackers would pay to access.
The threat model is not abstract. If a nation-state or ransomware syndicate had access to Mythos-class capabilities, they could automate zero-day discovery across widely deployed infrastructure at a scale that currently requires teams of elite researchers months to replicate manually. The FFmpeg vulnerability that survived 16 years of human and automated scanning is precisely the kind of target that AI-accelerated offense would identify faster than defenders could patch.
Anthropic’s Dianna Penn, Research Product Management Lead, described the decision to CNBC as “a preliminary move to provide numerous cyber defenders with an advantage on a subject that will grow increasingly vital.” That framing matters. The restriction is presented as temporary. Anthropic has indicated it is working on model-level safeguards that would allow a future Opus-class model to incorporate Mythos-level capabilities with guardrails sufficient to permit broader deployment.
What Anthropic is not doing is pretending that access controls alone solve the problem. The company acknowledged in its system card that Mythos presents a risk profile it considers too high for general release under current safety frameworks. That admission is more candid than typical vendor safety language and suggests that the internal debate about releasing the model was significant.
There is also an arms race logic buried in Glasswing’s structure. If defenders do not have access to the best available AI tools, attackers with equivalent or near-equivalent capabilities will find vulnerabilities faster than they can be patched. The partner coalition represents Anthropic’s attempt to get the most capable defenders access to the most capable tools before that gap opens.
The Enterprise Adoption Roadmap: A Five-Step Framework
Most enterprises are not in the Glasswing partner list. That creates a strategic planning question: what should you actually do now, and what should you be prepared for when Mythos-class capabilities become more broadly available?
1
2 to 3 weeks
Threat and asset mapping
Inventory your critical software assets, open-source dependencies, and current vulnerability management stack. Mythos’s documented value is greatest where legacy tools have failed, specifically long-lived bugs in widely trusted components. Without a ranked list of high-impact targets, deploying AI scanning tools generates noise rather than intelligence.
2
2 to 4 weeks
Vendor and access strategy
Engage account teams at AWS, Google Cloud, and Microsoft to understand your eligibility path for Glasswing participation. If direct access is unavailable, identify which existing security partners are integrating Mythos-class capabilities and begin evaluating how those integrations interact with your stack. Document contractual and data residency constraints before any pilot.
3
Parallel, 2 to 4 weeks
Governance and guardrails design
Define explicit policies for what any Mythos-adjacent tool can do within your environment: read-only code analysis, no production credentials, mandatory logging, and human review gates for any exploit proof-of-concept or patch recommendation. Restrict initial access to development mirrors and security sandboxes. Get written policy approved by security leadership before any test deployment begins.
4
4 to 8 weeks
Pilot deployment on high-value targets
Run the model on one to three high-value codebases or attack surfaces. Capture metrics that matter: vulnerabilities found, severity distribution, false positive rate, and time from identification to triage and patch. Compare these numbers against your current SAST, DAST, and bug bounty outputs. If Mythos is not surfacing findings your existing tools miss, the integration cost is not justified at this stage.
5
3 to 6 months
CI/CD integration and scaled automation
Once the pilot validates incremental value, integrate scanning into pre-merge pipelines for critical services. Enforce human code review on all AI-generated patches. Track mean time to remediation, backlog reduction, and exploitable attack surface shrinkage as primary business metrics. Build a cost model against the $25 per million input and $125 per million output token pricing to ensure the economics hold at scale.
Before any of the above steps, verify these prerequisites:
Complete inventory of critical software assets and open-source dependencies
Existing vulnerability management process with ticketing and SLA structures
Data-sharing agreements that permit code analysis by external AI services
IAM policies and network segmentation capable of sandboxing AI model access
Legal and compliance review completed, especially for finance, healthcare, and energy environments
Executive alignment on AI-augmented security as a budget priority for 2026
Risk Matrix: What Could Go Wrong
The “defense-first” framing of Project Glasswing is a policy choice, not a technical guarantee. Four risk categories deserve serious planning attention.
Offensive enablement
High Impact
Attackers gaining Mythos-class capabilities through leaks, competitive model development, or access control failures. The March 2026 CMS misconfiguration that exposed pre-release Mythos documentation illustrates that access controls fail. Mitigation requires strict governance, model-level safeguards, and government coordination, not access controls alone.
Code and data leakage
Medium Impact
Proprietary code or configuration data exposed through API integrations, logs, or vendor infrastructure. Data minimization protocols, redaction pipelines, and strong vendor data agreements are essential before any production codebase is submitted to external AI services. This risk is present today with all cloud-based code analysis tools.
Over-reliance and skill atrophy
Medium Impact
Organizations reducing human security expertise in response to AI capability gains, creating blind spots when the model fails or is unavailable. Mythos should be positioned as a force multiplier for existing teams, not a replacement. Maintain independent red team capacity and human review of all AI security outputs.
Regulatory and liability uncertainty
Medium Impact
Using frontier AI in safety-critical environments may trigger new regulatory duties, particularly in finance, healthcare, and energy under emerging AI governance frameworks. Early legal engagement with NIST, ENISA-equivalent bodies, and sector-specific regulators is preferable to retroactive compliance. The regulatory landscape around Mythos-class models is still being written.
Who It Affects and What They Should Do
The Mythos announcement touches every major stakeholder in the enterprise technology stack differently. The action items are not uniform.
Stakeholder
Immediate impact
Key decision in 2026
Risk of inaction
CISO / CTO
New frontier defensive capability; AI-accelerated threats regardless of access
Whether to pursue Glasswing access and restructure vuln management budget
Increased breach risk from AI-enabled attackers
Security engineers
Access to autonomous vuln discovery that outperforms existing tooling
How to integrate safely into workflows and maintain human oversight
Tool sprawl, misuse, and missed efficiency gains
Cloud / platform teams
Need to offer Mythos-level capabilities through managed platforms
Investment in AI-augmented security product offerings
Competitive loss to providers with better AI-security integration
Open-source maintainers
New funding and AI tooling for security without requiring large security teams
Whether to apply for Glasswing access via Linux Foundation or Apache programs
Continued under-resourced security in widely deployed packages
Policymakers and regulators
Concrete evidence of dual-use danger from frontier models
How to classify, oversee, and export-control Mythos-class capabilities
Regulatory lag and uncoordinated national responses to AI-aided attacks
For open-source maintainers specifically, the Linux Foundation’s Jim Zemlin framed the Glasswing funding as a structural shift: AI-augmented security as “a trusted sidekick for every maintainer, not just those who can afford expensive security teams.” The $2.5 million directed to Alpha-Omega and OpenSSF signals that Anthropic is treating the open-source supply chain as a specific attack surface that requires dedicated attention, which aligns with the FFmpeg and Linux kernel findings. These are libraries that underpin billions of deployments.
For NeuralWired readers who are early-stage founders or investors, the Glasswing structure points toward an emerging category that might be called defensive AI as a platform: the combination of AI-powered vulnerability discovery, automated patch generation, and continuous CI/CD security scanning as a unified product layer. The companies that build on top of Mythos outputs, including automated patch pipelines, attack surface intelligence feeds, and compliance verification tools, represent a significant market opportunity that is only beginning to take shape. For further context on AI investment patterns in 2026, see our AI investment landscape report.
The Skeptics Are Not Wrong
The “defense-only” framing around Mythos should be treated as a current policy position, not a permanent technical guarantee. Several lines of criticism deserve attention before any organization makes strategic decisions based on Anthropic’s assurances.
First, the leakage risk is real and has already occurred once. The March 2026 CMS misconfiguration that exposed Mythos documentation demonstrates that even well-resourced AI companies are not immune to the operational security failures that enable competitive intelligence and capability replication. If the architecture or training methodology behind Mythos-class vulnerability discovery becomes sufficiently well understood, competitive replication by less safety-conscious actors is plausible within two to three years.
Second, the benchmarks, while impressive, are vendor-run. Anthropic’s CyberGym, SWE-bench configurations, and Terminal-Bench evaluations are conducted on internal infrastructure with internal filtering. Independent replication has not yet occurred. That is not a reason to dismiss the findings, particularly given the case study evidence of specific, patched vulnerabilities. But it is a reason to weight the absolute numbers less heavily than the directional signal they represent.
Third, the economic reality of Mythos deployment may constrain its reach more than Anthropic’s access controls do. At $25 per million input tokens and $125 per million output tokens, scanning a large enterprise codebase continuously at the level required to capture long-lived vulnerabilities before attackers do could become expensive quickly. Organizations that lack the engineering maturity to integrate AI scanning into CI/CD pipelines will not realize the value, regardless of access.
Finally, community discussion in spaces like r/Anthropic has raised alignment concerns about a model with Mythos-level offensive capability that is deliberately kept from broad safety review. The 244-page system card indicates Anthropic’s internal risk assessment is thorough. Whether it is sufficient is a question that independent researchers and regulators will need to answer over time.
None of these objections invalidate the core strategic reality: AI-accelerated exploitation is coming regardless of what Anthropic does with Mythos. The question for every security-conscious organization is not whether to engage with AI-augmented defense. It is how to do so without creating new vulnerabilities in the process. For a broader view of how AI is changing the threat landscape, see our ongoing coverage at NeuralWired Cybersecurity.
The realistic timeline runs roughly as follows. From 2026 through 2027, Mythos remains restricted to the Glasswing coalition while Anthropic develops the model-level safeguards intended to enable a broader Opus-class release. From 2027 through 2028, Mythos-level capabilities, whether from Anthropic or from competitive models, will become more widely available with better governance frameworks. Over a five to ten year horizon, AI-augmented vulnerability discovery becomes standard in large enterprises and the offense-defense balance shifts to whoever deploys these capabilities more effectively and more responsibly.
Frequently Asked Questions
What is the Anthropic Claude Mythos AI model preview?
Claude Mythos Preview is Anthropic’s newest and most powerful frontier AI model, optimized for advanced coding, reasoning, and cybersecurity tasks. It can autonomously identify and exploit complex software vulnerabilities, outperforming the earlier Claude Opus 4.6 on benchmarks including CyberGym, SWE-bench Verified, and Terminal-Bench. Anthropic describes it as the most powerful model they have ever built and is currently limiting access to vetted organizations through Project Glasswing.
Why is Anthropic restricting access to the Mythos AI model?
Anthropic is keeping Mythos in a closed preview because the model can find and exploit software vulnerabilities with an effectiveness that creates serious dual-use and cyberattack risks if widely released. As outlined in the official announcement and follow-up reporting, the company plans to develop stronger model-level safeguards before considering broader deployment. The decision reflects a specific risk calculation, not a product strategy.
How is Claude Mythos different from Claude Opus?
Compared to Claude Opus 4.6, Mythos delivers double-digit gains across software engineering and cybersecurity benchmarks. On SWE-bench Pro, the gap is more than 24 percentage points; on CyberGym, more than 16. Mythos also demonstrates stronger agentic coding capabilities, autonomously discovering long-standing vulnerabilities in widely used systems like OpenBSD, FFmpeg, and the Linux kernel without human guidance at each step.
What is Project Glasswing?
Project Glasswing is Anthropic’s cross-industry initiative to use Claude Mythos Preview to secure the world’s most critical software. It brings together 11 founding partners including AWS, Apple, Microsoft, Google, and Cisco, plus more than 40 additional institutions, to scan and harden essential software and open-source infrastructure. Anthropic has committed up to $100 million in usage credits and $4 million in direct funding to open-source security organizations as part of the program. Full details are at anthropic.com/glasswing.
Which companies have early access to Claude Mythos Preview?
The 11 founding partners are Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. More than 40 additional organizations that build or maintain critical software infrastructure also have access for defensive security work. The full partner list has not been made public beyond these named organizations.
Can the public use the Claude Mythos AI model?
No. Anthropic does not plan to make Claude Mythos Preview generally available. Access is restricted to vetted organizations through Project Glasswing and select cloud platforms including Google Cloud Vertex AI, Amazon Bedrock, and Microsoft Azure Foundry. Even Glasswing participants are expected to use the model exclusively for defensive cybersecurity purposes.
How does Claude Mythos help with cybersecurity?
Mythos can scan codebases and binaries autonomously to detect previously unknown vulnerabilities, generate exploit proof-of-concepts, and propose patches, often identifying issues that traditional automated tools and human researchers miss. Anthropic reports it has already found thousands of high-severity issues, including long-standing bugs in every major operating system and web browser, with specific documented cases in OpenBSD, FFmpeg, and the Linux kernel.
What are the risks if a model like Mythos is weaponized?
If attackers gain access to Mythos-class capabilities, they could automate zero-day discovery and exploitation across widely deployed software at a speed and scale no human security team could match. This is the primary reason Anthropic has restricted access and is working with governments on oversight frameworks. As CrowdStrike’s CTO noted, adversaries will inevitably seek equivalent capabilities, making governance as important as the access controls themselves.
Is Claude Mythos available on Google Cloud or AWS?
Yes, but only for vetted Glasswing participants. Claude Mythos Preview is available in private preview on Google Cloud Vertex AI and is being used within AWS security operations as part of the Glasswing program. This access is invitation-only and limited to organizations focused on defensive cybersecurity use cases. General-purpose access through these platforms is not currently available.
What benchmarks does Claude Mythos achieve?
According to Anthropic’s documentation and the Mythos system card summary, key scores include: CyberGym 83.1%, SWE-bench Verified 93.9%, SWE-bench Pro 77.8%, Terminal-Bench 82.0%, GPQA Diamond 94.6%, and USAMO 2026 97.6%. These are vendor-run benchmarks and have not yet been independently replicated, but specific vulnerability case studies accompany the claims as corroborating evidence.
What the Glasswing Moment Actually Means
The pattern across what Anthropic has revealed about the Anthropic Mythos AI model preview points to a more significant structural shift than a single model announcement. The combination of autonomous vulnerability discovery, agentic code analysis, and cross-industry partner governance represents the first serious attempt to operationalize frontier AI as critical security infrastructure rather than as a productivity layer. The distinction matters enormously for how organizations plan, budget, and staff their security functions over the next three years.
Anthropic’s choice to restrict Mythos rather than release it broadly is not a setback for defenders. It is a recognition that the offense-defense balance in AI-augmented security is genuinely fragile and that deploying the most capable tools requires proportionally capable governance. Every organization that waits for the public release before engaging with this question will find itself two or three cycles behind when that release arrives.
Watch for three developments that will define the next phase. First, Anthropic’s 90-day Glasswing progress report, which will be the first empirical evidence of what Mythos deployment at scale actually produces in terms of patched vulnerabilities and prevented exposure. Second, competitive responses from OpenAI, Google DeepMind, and open-source model developers, who will face pressure to match Mythos-class capability in their own security-oriented offerings. Third, the regulatory response in the United States and European Union to the category of intentionally withheld frontier models, which will shape how future access restrictions are governed and what disclosure obligations apply.
Organizations that build the governance infrastructure, vendor relationships, and internal competency to work with AI-augmented security tools now, before the market matures and the regulatory environment solidifies, will hold a durable advantage. Those that treat Glasswing as a story to monitor rather than a signal to act on will find themselves reacting rather than leading when the next wave arrives.
For more on how frontier AI models are reshaping enterprise risk frameworks, see the NeuralWired Enterprise AI Risk series and subscribe to The Neural Loop for weekly frontier intelligence delivered to your inbox.
Disclaimer: This article is based on publicly available information from Anthropic’s official disclosures, partner statements, and third-party press coverage as of April 8, 2026. Benchmark data cited reflects vendor-reported figures that have not been independently verified. This article does not constitute financial, legal, or cybersecurity advice. NeuralWired has no commercial relationship with Anthropic or any Project Glasswing partner referenced in this piece.
NeuralWired.com | Elite-class frontier technology intelligence for technologists, executives, founders, policy professionals, and investors shaping what comes next. This analysis is part of our ongoing AI Security coverage series.
Breaking Analysis · AI Supply Chain Security · April 4, 2026
The Mercor LiteLLM supply chain breach wasn’t a fluke it was the inevitable collision of AI infrastructure’s explosive growth and its catastrophic security debt. Here’s everything you need to know, act on, and watch for.
The Attack That Exposed AI’s Hidden Dependency Crisis
The malicious packages stayed live on PyPI for roughly three hours. That was enough. When TeamPCP a sophisticated multi-ecosystem threat actor pushed backdoored versions of LiteLLM (v1.82.7 and v1.82.8) onto the Python Package Index in late March 2026, they didn’t need days or weeks of access. Thousands of AI pipelines automated, hungry for the latest dependencies, running in CI/CD environments across the globe pulled those packages and executed their payload before most security teams had their morning coffee.
The downstream fallout has been extraordinary. Mercor, a $10 billion AI recruiting and annotation startup whose clients include OpenAI, Anthropic, and Meta, confirmed it was breached via the LiteLLM compromise becoming the first organization to publicly acknowledge being victimized through the TeamPCP campaign. The extortion group Lapsus$ claims to have walked away with 4TB of data: 939GB of source code, a 211GB user database, and roughly 3TB of video interviews and passport-scan identity documents from Mercor’s contractor network. Meta has since paused its work with Mercor while it investigates.
This article gives you the definitive account of what happened, how it happened, and most critically what you need to do about it. You’ll get the full Trivy-to-Mercor attack chain, a forensic breakdown of the malicious payload, a five-step incident response playbook, a vendor assessment checklist, and a risk framework for every component in your AI stack. Whether you’re a DevSecOps engineer auditing dependencies, a CISO briefing your board, or a founder deciding how much to trust third-party AI tooling, this is the resource you’ll send to your team.
⚠ Immediate Action Required
If your organization uses LiteLLM, check your dependency manifests now for versions v1.82.7 or v1.82.8. Even if you didn’t install these versions directly, CI/CD environments that ran during the exposure window may have pulled them transitively. See Section 5 for the full response playbook.
The Attack Chain: From Trivy to 4TB in Nine Days
To understand the Mercor LiteLLM supply chain breach, you need to go upstream. LiteLLM didn’t fail on its own. It was the third domino in a carefully engineered cascade that started with a security tool, of all things.
Phoenix Security’s forensic analysis of the TeamPCP campaign shows that the attack almost certainly began when a compromised Trivy CI/CD action ran inside LiteLLM’s own build pipeline. Trivy is a widely used open-source vulnerability scanner the kind of tool organizations add to their pipelines specifically to improve security. When the compromised action ran, it harvested LiteLLM’s PyPI publishing token. TeamPCP then used that token to push malicious releases directly to PyPI, bypassing GitHub’s version history entirely. No one outside the project’s maintainers would have seen the change coming.
// Attack Timeline: Trivy → LiteLLM → Mercor
1
~Mar 19-22, 2026
Trivy CI/CD Credential Theft
TeamPCP compromises a Trivy GitHub Action. When it runs in LiteLLM’s pipeline, it exfiltrates the PyPI publishing token. The project is unaware.
2
Mar 23, 2026
Malicious LiteLLM Releases Pushed to PyPI
TeamPCP publishes v1.82.7 and v1.82.8 to PyPI. Packages contain a three-stage credential harvesting payload embedded via a .pth auto-execution file. They remain live for approximately three hours before quarantine.
3
Mar 23-29, 2026
Thousands of AI Pipelines Pull Infected Packages
Automated CI/CD jobs and development environments at enterprises, AI labs, and AI startups worldwide pull the malicious versions. Credential theft begins immediately on package installation. The campaign targets at least five ecosystems: PyPI, npm, Docker Hub, GitHub Actions, and OpenVSX.
4
Late Mar 2026
Mercor Network Compromised via Tailscale VPN Credentials
Following LiteLLM-driven credential theft, attackers reportedly use a compromised Tailscale VPN credential for initial access to Mercor’s infrastructure. Lateral movement and data staging begin.
Mercor publicly discloses the incident, calling itself “one of thousands of companies” affected. SANS ISC designates Mercor as the first officially confirmed victim of the TeamPCP campaign.
6
Apr 3-4, 2026
Meta Pauses Work with Mercor
Business Insider confirms Meta has paused its AI training relationship with Mercor while it investigates exposure. The commercial fallout begins for a company valued just months earlier at $10 billion.
Trend Micro’s research team describes this as one of the most sophisticated multi-ecosystem supply chain campaigns publicly documented to date. The key insight that separates this campaign from run-of-the-mill package typosquatting: attackers didn’t create a fake LiteLLM package. They published to the real one, using legitimate credentials, making automated trust checks essentially useless.
Inside the Payload: What the Malicious LiteLLM Actually Did
The malicious LiteLLM package didn’t run obvious, easily-flagged code. It used a .pth file a Python path configuration mechanism that auto-executes on interpreter startup to ensure the payload ran any time Python initialized in the infected environment. You didn’t have to import LiteLLM. Installing it was enough.
The payload searched for and exfiltrated over 50 categories of secrets SSH keys, AWS and GCP access tokens, Kubernetes secrets, crypto wallet keys, .env files, and API credentials for LLM providers like OpenAI, Anthropic, and Cohere. For AI companies, these aren’t peripheral credentials. They’re the keys to the entire model inference and training infrastructure.
02
Stage 2: Kubernetes Lateral Movement
If a Kubernetes environment was detected, the payload attempted to deploy privileged pods to every node in the cluster. This isn’t just credential theft it’s a full cluster takeover bid, giving attackers the ability to observe, intercept, or modify workloads across the entire AI compute environment. Training jobs, inference services, data pipelines: all exposed.
03
Stage 3: Persistent Systemd Backdoor
Finally, the payload installed a systemd backdoor service that polled attacker-controlled infrastructure for additional binaries. Even if you removed the malicious package, the backdoor could persist and continue receiving new payloads until explicitly hunted and eradicated. Uninstalling LiteLLM and moving on is not a remediation strategy.
“Once triggered, the payload runs a three-stage attack: it harvests credentials (SSH keys, cloud tokens, Kubernetes secrets, crypto wallets, and .env files), attempts lateral movement across Kubernetes clusters by deploying privileged pods to every node, and installs a persistent systemd backdoor that polls for additional binaries.”
Endor Labs researcher, quoted in BleepingComputer, March 23, 2026
The .pth execution mechanism deserves special attention. Security teams focused on import-time analysis, runtime behavior detection, or network egress monitoring at the application layer may miss a payload that fires at the Python interpreter level before any application code runs. This is precisely why standard dependency auditing checking version numbers and known CVEs isn’t sufficient for AI supply chain risk.
Why the Mercor Breach Hits Differently
Every major supply chain breach is serious. This one is in a different category. Here’s why.
LiteLLM Is Everywhere in AI Infrastructure
LiteLLM isn’t a niche tool. It’s a unified interface that routes to over 100 LLM provider APIs OpenAI, Anthropic, Cohere, Mistral, Bedrock, Vertex, and dozens more. It’s used in AI agent frameworks, MCP servers, orchestration tools, and model evaluation pipelines across the industry. It has tens of thousands of GitHub stars and deep integration in precisely the kind of AI-adjacent tooling that organizations adopt quickly and audit slowly. Compromising LiteLLM is like compromising a universal key that fits every door in the AI infrastructure building.
Mercor’s Client List Is a Who’s Who of Frontier AI
Mercor doesn’t just work with any companies. Its clients reportedly include OpenAI, Anthropic, and Meta the organizations training the most powerful and commercially significant AI systems in the world. Mercor provides these clients with recruiting services, contractor management, data annotation, and AI training support. That means the company’s systems potentially touch training data, annotation workflows, and contractor identity information for frontier AI development. Even if no model weights were exfiltrated, the blast radius calculation changes entirely when this is your vendor’s client list.
The Data You Can’t Rotate
Most breach responses follow a standard playbook: rotate credentials, update keys, patch the vulnerability. The Mercor breach adds a dimension that playbook doesn’t cover well.
“The most alarming part of the Mercor breach isn’t just the source code theft it’s the biometric and identity data that can’t be rotated. You can change a password or an API key; you can’t change your face or the passport video you used to onboard to a training platform.”
IQ Source, “Mercor Breach: 4 TB of Biometric Data You Can’t Rotate,” March 31, 2026
Of the alleged 4TB exfiltrated, approximately 3TB consists of video interviews and passport-scan identity documents collected as part of Mercor’s contractor onboarding process. These documents belong to the thousands of contractors data annotators, AI trainers, evaluators who completed identity verification to work on AI training projects for top-tier labs. You can’t issue new passports. You can’t re-record someone’s face. The long-tail privacy risk from this data persists for years, and the fraud potential compounds every time it moves through threat-actor markets.
// Alleged Exfiltrated Data Breakdown (Lapsus$ Claim)
939 GB source code · 211 GB user database · ~3 TB video interviews & identity documents (passports). Total: ~4 TB. Note: Volumes are attacker-reported. Mercor has confirmed a significant breach but has not publicly validated specific size figures. Source: SANS ISC, March 31, 2026.
The commercial fallout is already moving faster than the forensics. Meta has paused its work with Mercor. A $10 billion company built on trust trust from contractors sharing their identities, trust from AI labs sharing their workflows now has both eroded simultaneously. As Kenneth Hartman of SANS ISC noted in the campaign’s Update 005 diary, Mercor “has publicly confirmed it was breached as a direct consequence of the LiteLLM supply chain compromise, making it the first organization to officially acknowledge being victimized through the TeamPCP campaign.” That phrase “first organization” should be read as a warning: it won’t be the last.
Incident Response Playbook for Affected Organizations
If your organization uses LiteLLM directly, or via any AI framework that depends on it here is the structured response sequence. Don’t treat this as a “check if we installed the bad version” exercise. Given the three-stage payload and persistent backdoor, the scope of required remediation is considerably larger.
01
Confirm Exposure Window (0-24 Hours)
Determine whether any system, container, or CI/CD job installed litellm==1.82.7 or litellm==1.82.8 during the malicious window. Check your SBOM tooling, pip install logs, lockfiles (requirements.txt, poetry.lock, Pipfile.lock), container image manifests, and build logs. Also check for the malicious C2 domains published by Phoenix Security and Trend Micro in your egress logs. Don’t assume only direct dependencies matter transitive installs and CI environments are primary exposure vectors.
02
Rotate All Potentially Exposed Credentials (24-72 Hours)
The payload targeted over 50 secret types. Rotate aggressively: cloud provider access keys (AWS, GCP, Azure), LLM provider API keys, Kubernetes secrets and service account tokens, SSH keys on any host that ran the package, .env-file contents, CI/CD pipeline secrets, and crypto wallet keys. Don’t wait for forensics to confirm compromise before rotating. Assume compromise and rotate then verify.
Monitor for usage of old credentials after rotation. Continuing usage after revocation confirms active attacker access.
03
Hunt for Persistence and Lateral Movement (1-2 Weeks)
This is the step most organizations skip and then regret. Use published IOCs from Trend Micro, Phoenix, and Endor Labs to systematically search for: unexpected systemd services installed after the exposure window; anomalous Kubernetes pods in your clusters (especially privileged or DaemonSet-style deployments you didn’t create); outbound connections to unknown infrastructure; and signs of credential replay from unexpected IPs or regions.
Treating this as a package-uninstall problem will leave you with a persistent backdoor.
04
Assess Your AI Vendor Exposure (1-4 Weeks)
If you use AI data vendors, annotation providers, or training services especially any that use LiteLLM or similar AI gateway libraries contact them now. Request their incident response statement specific to the LiteLLM compromise, ask for their current SBOM for key services, and verify what Tailscale or VPN credential controls they have in place. The Mercor case demonstrates that vendor compromise can expose your contractors’ identities, your training workflows, and your annotated data not just the vendor’s own systems.
05
Regulatory and Legal Response (Ongoing)
If any of your contractors’ or users’ identity documents, biometric data, or personal information may have been exposed via a vendor like Mercor, engage your data protection officer and privacy counsel immediately. Biometric data carries special classification under GDPR Article 9, CCPA, and numerous state-level biometric privacy laws (BIPA in Illinois, for example). Notification obligations may be triggered; delays compound regulatory exposure. The “non-rotatable” nature of biometric data makes the individual harm calculation more severe, which regulators are increasingly factoring into enforcement decisions.
AI Vendor Supply Chain Risk Checklist
Send this to your AI data vendors, annotation providers, orchestration tool vendors, and any third-party touching your model pipelines. The Mercor breach didn’t happen in a vacuum it happened because security questionnaires for AI vendors haven’t caught up to AI vendors’ actual attack surface.
// Vendor Security Assessment: AI Supply Chain (Post-LiteLLM)
Do you use LiteLLM, LangChain, or similar AI gateway libraries in your production infrastructure? If yes, which versions are deployed, and what remediation steps did you take after March 24, 2026?
Provide a current Software Bill of Materials (SBOM) for your key services, including transitive Python and JavaScript dependencies used in AI orchestration, annotation, or inference pipelines.
How are your PyPI, npm, and container registry publishing credentials managed? Are they stored in CI/CD systems, and how are they isolated from the workloads that consume those packages?
What controls prevent a compromised third-party CI/CD action (e.g., a GitHub Action like Trivy) from exfiltrating secrets used in your own publishing pipeline?
Describe your secret-management approach are secrets stored in a dedicated KMS (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager), what are your rotation policies, and do you run automated scanning for hard-coded secrets in repos and container images?
What logging and telemetry do you maintain for package installation events, and do you alert on anomalous outbound connections from build and inference environments?
What are your Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) benchmarks for a supply chain compromise event? Have you exercised this scenario in a tabletop or red team exercise in the past 12 months?
For data labeling, annotation, and recruiting vendors: how are contractor biometric data, identity documents, and video recordings stored? Are they encrypted at rest with customer-managed keys? Who has access, and what retention and deletion policies govern them?
What contractual commitments indemnification clauses, SLA penalties, incident notification timelines apply if your supply chain results in exfiltration of our data or our contractors’ personal information?
Have you retained a third-party forensics firm to investigate the LiteLLM exposure window? When do you expect to provide a final incident report?
Where AI Supply Chains Break: Risk Hotspots Across the Stack
The LiteLLM campaign didn’t just compromise one tool. It exposed a structural problem: AI infrastructure is built on a dense, poorly-audited web of dependencies, each of which can serve as an entry point. Here’s how the risk breaks down across the key components in a typical AI stack.
Stack Component
Example Tools
Credential Risk
Data Exfil Risk
IP Leakage Risk
Compliance Risk
AI Gateway / Proxy
LiteLLM, OpenRouter
HIGH
HIGH
HIGH
HIGH
CI/CD Actions
Trivy, GitHub Actions
HIGH
MED
MED
LOW
Annotation / Labeling Vendor
Mercor, Scale AI
MED
HIGH
HIGH
HIGH
Orchestration Framework
LangChain, CrewAI
HIGH
MED
MED
MED
Evaluation Tooling
Evals frameworks, RLHF tooling
LOW
MED
MED
LOW
Container / Image Registry
Docker Hub, GHCR
HIGH
MED
HIGH
LOW
Cloud Infra (K8s / Serverless)
EKS, GKE, Lambda
MED
HIGH
HIGH
MED
The table makes one thing clear: AI gateways like LiteLLM are the highest-risk single point in the stack because they concentrate API keys and cloud credentials for every LLM provider in use. As Trend Micro Research observed, “AI proxy services that concentrate API keys and cloud credentials become high-value collateral when supply chain attacks compromise upstream dependencies.” One compromised gateway = every model provider credential, simultaneously.
The Contrarian View: Don’t Panic, But Don’t Look Away
The temptation after an incident like this is to swing hard in the other direction ban open-source AI tooling, rebuild everything in-house, treat every PyPI package as hostile. That reaction creates as much risk as it mitigates.
The problem isn’t that LiteLLM is open-source. Open-source software’s transparency is genuinely a security asset over time: vulnerabilities get found, discussed, and fixed in the open. The problem is organizational: most teams that adopted LiteLLM did so with the same diligence they’d apply to a SaaS subscription, not a critical infrastructure dependency. That mismatch between deployment speed and security rigor is where the breach lives, and rebuilding in-house doesn’t fix it it just changes which codebase you fail to audit.
What does help:
Treat AI dependencies as critical infrastructure. Organizations that require SBOMs, pin dependencies, and review transitive package graphs for database connectors should do the same for AI libraries. The blast radius of a compromised AI gateway dwarfs most database vulnerabilities.
Minimize the secrets your AI tools can see. LiteLLM’s credential exposure was so severe because many deployments gave it access to all LLM provider keys simultaneously exactly the design it enables. Scope credentials tightly. Use separate keys per provider, rotate them on short cycles, and consider whether your AI gateway needs to run with the same permissions as your cloud control plane.
Design for resilience, not just prevention.Phoenix Security’s analysis notes that the malicious packages were live for only about three hours. Good tooling didn’t prevent that window but organizations with strong egress monitoring, anomaly detection, and fast credential revocation workflows would have contained the damage significantly. Prevention is insufficient. Assume compromise and build resilient response.
// The Realistic Timeline
Vendor narrative: “We’ve patched the package and rotated keys risk is contained.” | Reality: Full credential rotation, backdoor eradication, vendor assurance, regulatory notification, and insurance claims will span weeks to months across most AI-heavy organizations. Early-stage companies without mature IR practices face even longer timelines, and some will never fully close their exposure windows.
Frequently Asked Questions
The Mercor LiteLLM supply chain breach is a 2026 security incident in which threat actor TeamPCP compromised the open-source LiteLLM library on PyPI, embedding a credential-stealing payload. AI recruiting and annotation startup Mercor serving clients including OpenAI, Anthropic, and Meta confirmed it was breached via this compromise, with extortion group Lapsus$ claiming to have exfiltrated approximately 4TB of sensitive data including source code, user databases, and identity documents. TechCrunch coverage →
TeamPCP almost certainly stole LiteLLM’s PyPI publishing token by running a compromised Trivy CI/CD action inside LiteLLM’s own build pipeline. Using that token, they published malicious versions 1.82.7 and 1.82.8 directly to PyPI bypassing GitHub’s version history with a three-stage payload embedded via a .pth auto-execution file. The packages remained live for approximately three hours before quarantine, but that window was enough to reach thousands of environments. Phoenix Security analysis →
According to attacker claims corroborated by SANS ISC and multiple security analyses, the alleged exfiltration includes approximately 939GB of source code, a 211GB user database, and roughly 3TB of video interviews and passport-style identity verification documents collected during contractor onboarding. The biometric and identity components are particularly serious because they cannot be “rotated” the way credentials can. Note that Mercor has confirmed a significant breach but has not publicly validated specific volume figures. SANS ISC Update 005 →
Mercor has publicly confirmed being breached and describes itself as one of thousands of organizations affected. Any organization that installed LiteLLM v1.82.7 or v1.82.8 during the exposure window may have had credentials harvested. Mercor’s clients reportedly include OpenAI, Anthropic, and Meta, though no evidence has been published that those companies’ own systems or training data were directly accessed. Meta has paused its work with Mercor while investigating. Business Insider coverage →
Scan your SBOM tooling, dependency manifests, pip install logs, and container image layers for LiteLLM versions 1.82.7 or 1.82.8. Review your network egress logs against the C2 domains published by Trend Micro, Phoenix Security, and Endor Labs. Check for unexpected systemd services or Kubernetes pods deployed around the exposure window (approximately March 23, 2026). Also audit CI/CD build logs the package may have been installed transiently in a build environment even if it’s not in production dependencies. Upwind Security guide →
Three compounding factors. First, Mercor’s clients include frontier AI labs, meaning the blast radius touches the most commercially sensitive AI training and annotation workflows in the industry. Second, the exfiltrated data includes biometric and identity documents that cannot be remediated the way credentials can affected contractors face permanent, long-tail fraud and privacy risk. Third, the incident demonstrates that AI infrastructure’s rapid growth has created a class of high-value targets AI gateways, annotation platforms, evaluation tooling that the security industry hasn’t yet developed robust governance frameworks for. IQ Source analysis →
In priority order: (1) Identify all systems that installed LiteLLM v1.82.7 or v1.82.8. (2) Rotate all credentials on affected hosts cloud tokens, API keys, SSH keys, Kubernetes secrets. (3) Hunt for the persistent systemd backdoor and anomalous Kubernetes pods using published IOCs. (4) Contact AI-related vendors to assess their LiteLLM exposure and remediation. (5) Engage legal and privacy counsel if any personal or biometric data may have been involved. See the full five-step playbook in Section 5. Full breakdown →
Most security experts say no. The problem isn’t open-source AI tooling it’s the gap between adoption velocity and security governance. The right response is treating AI dependencies as critical infrastructure: requiring SBOMs, pinning versions, monitoring installs, scoping credential access tightly, and maintaining egress visibility. Wholesale abandonment of open-source AI tooling in favor of rushed in-house rebuilds creates different, often larger risks. Upwind Security →
In the short term: vendor pauses, security reviews, and stricter contract terms are already happening (see Meta’s pause on Mercor). In the medium term: expect accelerated investment in AI-supply-chain security tooling, SBOM requirements in procurement, and more rigorous vendor due diligence frameworks. In the long term: this breach may prove a positive forcing function the kind of high-profile incident that finally drives AI teams to adopt the supply-chain governance practices that software-at-large learned from SolarWinds and Log4Shell. Market context →
What Comes Next
The Mercor LiteLLM supply chain breach reveals something the AI industry has managed to avoid confronting at scale until now: the attack surface of modern AI infrastructure isn’t primarily the models. It’s the dense, fast-moving, poorly-governed dependency graph underneath them. TeamPCP didn’t need to crack a foundation model or defeat an alignment system. They compromised a CI/CD scanner, stole a publishing token, and waited three hours. The rest was automated.
The structural lesson isn’t unique to AI it’s the same lesson the software industry learned from SolarWinds in 2020 and Log4Shell in 2021. But AI’s particular characteristics make it acutely vulnerable: adoption velocity that outruns security governance, deep integration of credential-rich gateway tools, and a category of data biometrics, identity documents, annotated training material that carries long-tail risk well beyond what typical credential rotations can address.
Three developments are worth watching in the months ahead. First: whether Mercor is truly “one of thousands” or the first of many public disclosures, as affected organizations complete forensic investigations and face disclosure timelines. Second: whether the AI developer tools market sees a consolidation or bifurcation between providers who can demonstrate security maturity via SBOMs, audits, and incident-response track records, and those who can’t. Third: whether regulators particularly those with jurisdiction over biometric data use the Mercor breach to accelerate enforcement action that establishes precedent for how AI training vendors must protect contractor identity data.
The Mercor LiteLLM supply chain breach is not the last attack of its kind. It’s the proof-of-concept that made the playbook obvious. Organizations that build AI supply chain governance now before the next campaign, before the regulation, before the next Meta-style contract pause will be the ones that don’t have to write that breach disclosure.
Disclaimer: This article is an editorial analysis compiled from publicly available security research, news reporting, and attacker claims. Volume and data figures attributed to Lapsus$ are unverified attacker claims; Mercor has confirmed a significant breach but has not publicly validated specific data volumes. NeuralWired is not a cybersecurity firm and this analysis does not constitute legal, compliance, or incident response advice. Consult qualified security and legal professionals for decisions affecting your organization.
NeuralWiredResearch-backed technology analysis for professional decision-makers
Cybersecurity·March 26, 2026·
Only 24% of enterprises have fully deployed zero trust. The rest are stuck, burned, or still planning. Here’s what separates the ones that make it from those that don’t.
Sixty-five percent of enterprise zero trust deployments collapse before they reach scale. Not because the security model is flawed. Because organizations scope it wrong, sequence it wrong, or skip identity entirely, then wonder why three years later their network still behaves like it’s 2015.
According to Forrester’s Zero Trust research, only 24% of enterprises have fully implemented zero trust architecture. Meanwhile, Cisco’s 2025 Annual Cybersecurity Report found that 82% of organizations now operate across hybrid and multi-cloud environments, where the traditional perimeter model has already collapsed. The gap between necessity and execution is real, and expensive.
This guide covers what that 24% did differently. We break down the NIST 800-207 seven-pillar framework, lay out a 12-month enterprise implementation roadmap, expose the five failure patterns that sink 65% of projects, and examine where AI agents fit into a zero trust model in 2026. Based on government standards, analyst data, and real deployment case studies, this is the zero trust implementation guide that replaces six browser tabs.
The Case Is Already Closed: Why Zero Trust Isn’t Optional Anymore
The “why zero trust” debate is over. The question now is why so few have actually done it.
IBM’s Cost of a Data Breach Report 2025, which analyzed 600-plus confirmed breaches, found that zero trust adopters reduced breach impact costs by 50% compared to organizations relying on perimeter controls. ESG’s economic validation puts the 3-year ROI at 248% across 15 studied organizations. And according to a SecurityWeek survey of 350 CISOs, 76% ranked zero trust as their top priority for 2026.
The business case isn’t ambiguous. But execution pressure is real.
“Zero trust is shifting from ambition to necessity. Eighty percent of enterprises will adopt by 2027, but most fail without identity-first sequencing.”
Chase Cunningham, VP Analyst, Gartner (February 2026)
Cunningham’s point on sequencing isn’t a footnote. It’s the crux of why deployments stall. Organizations treat zero trust as a technology purchase when it’s actually an architectural transformation. They buy ZTNA tools before they’ve mapped their identity posture, then get stuck when legacy systems can’t enforce dynamic policies.
The MarketsandMarkets forecast puts the zero trust architecture market at $30.4 billion in 2025, growing to $96.5 billion by 2030 at a 26% CAGR. Zscaler’s State of Zero Trust 2026 report found 92% of Fortune 100 companies now use ZTNA tools in some form. The adoption curve is steep. The full-deployment rate is not.
The gap comes down to one thing: skipping the foundations.
NIST 800-207 and the 7 Pillars of Zero Trust Architecture
Before scoping, budgeting, or buying tools, every enterprise needs a shared definitional framework. NIST SP 800-207 provides exactly that. It defines seven pillars that together constitute zero trust architecture, each assuming breach by default and enforcing least-privilege access dynamically.
“The seven pillars must be implemented iteratively to avoid common pitfalls like over-scoping.”
Rose Schulte, Sr. Director of Zero Trust, NIST (January 2026)
Schulte’s caution about iteration is exactly where most enterprises go wrong. They read the pillars as a checklist to complete simultaneously, which is why 65% end up over-scoped before they hit month four. The pillars are best understood as a sequenced architecture, not a parallel deployment plan.
PillarCore FunctionPrimary ToolsKey Metric
1. User
Verify every user explicitly via MFA and behavioral analytics
Policy as code, dynamic response, SOAR orchestration
Palo Alto XSOAR, Tines, OPA
MTTD < 1 hour
The order matters. Identity and device (pillars 1 and 2) are prerequisites for everything downstream. You can’t enforce network segmentation policies without knowing who owns which device. You can’t write application access rules without a coherent user identity fabric. Start there.
The CISA Zero Trust Maturity Model v2.0 provides a companion measurement framework with four stages: Traditional, Initial, Advanced, and Optimal. Most enterprises entering a zero trust program sit at Traditional or Initial. A realistic 12-month goal is reaching Advanced, defined by consistent policy enforcement across at least 80% of traffic.
The 12-Month Zero Trust Implementation Roadmap
IDC research based on interviews with 200 enterprises puts the average implementation timeline at 12 to 18 months. The faster end of that range belongs to organizations that sequenced correctly from day one. The 18-month end belongs to those that didn’t.
Four phases, no shortcuts.
Phase 1 · Months 1–3
Assess, Inventory, and Secure Executive Buy-In
Run a full asset inventory, targeting 90% completeness before proceeding. Map existing identity infrastructure. Use the CISA Maturity Model to benchmark your current stage. Secure a CISO-level sponsor and allocate 2–5% of IT budget. Deploy MFA everywhere. Establish baseline metrics before touching architecture.
Phase 2 · Months 4–6
Build the Identity Fabric and Microsegment Crown Jewels
Modernize IAM with a platform like Okta or Ping. Implement policy-based access controls (PBAC). Begin microsegmenting your highest-risk, highest-value workloads first. Don’t touch everything. Illumio’s segmentation platform provides enterprise microsegmentation patterns that CISA recommends for Zero Trust Network pillar implementation.
Phase 3 · Months 7–9
Expand to Applications, Data, and Remote Access
Move all remote access from VPN to ZTNA. Apply data classification policies. Extend access controls to SaaS applications. Per Okta’s Zero Trust Framework guide, MFA plus policy-based access controls is among the highest-ROI controls an enterprise can deploy in this phase.
Phase 4 · Months 10–12
Automate, Measure, and Audit Maturity
Deploy SIEM and SOAR tooling (Splunk, Elastic, Palo Alto XSOAR). Implement policy as code with Open Policy Agent. Run a formal CISA maturity audit. Your target: Advanced stage, 80% traffic inspected, breach containment under one hour. Document gaps for Year 2 roadmap.
Prerequisites Checklist
Before starting Month 1, confirm: executive sponsor identified · asset inventory at least 70% complete · IAM modernization budget approved · security team briefed on NIST 800-207 pillars · baseline KPIs defined.
One detail the timeline doesn’t capture: the organizational change management piece. Zero trust touches HR (onboarding/offboarding), IT ops (device management), legal (data classification), and app teams (API controls). Without cross-functional ownership from day one, the program stalls in committee by month three.
5 Failure Patterns That Kill Zero Trust Projects
Analysis of real-world zero trust deployments from NIST’s published internal research and Ponemon Institute is blunt about why projects fail. The data isn’t flattering.
65%
Over-Scoping (“Boil the Ocean”)
Teams try to secure everything at once. Nothing reaches production. Scope to your crown jewels first, then expand methodically.
40%
Poor Identity Management
Per Gartner Peer Insights, the single most common root cause of ZT failure across hundreds of reviewed enterprise deployments.
40%
Legacy Integration Ignored
Older systems can’t enforce dynamic policies. Teams underestimate refactoring cost, then stall when integration complexity hits month six.
50%
No Measurement Framework
Projects without defined KPIs (policy denial rate, traffic inspection %, MTTD) can’t demonstrate progress and lose executive funding mid-program.
John Kindervag, who coined “zero trust” in 2010 and now serves as evangelist at Palo Alto Networks, identified a fifth failure mode that cuts across all four above:
“Microsegmentation isn’t optional. It stops 99% of lateral movement, but enterprises botch it with legacy VLANs.”
John Kindervag, Palo Alto Networks, via Dark Reading
The VLAN problem is pervasive. Teams inherit flat network segments that were never designed for zero trust enforcement. Rather than redesign them, they layer ZT tools on top and hope for the best. Illumio’s 2025 Global Cloud Detection and Response Report, from a survey of 1,150 cybersecurity leaders, found that nearly 90% experienced a cybersecurity incident involving lateral movement in the past year. Proper microsegmentation is the fix. Overlaying new tools on legacy VLANs doesn’t count.
The Cost Reality
Zero trust initial costs run 2–5% of IT budget, for large enterprises that’s $5 million or more. Hidden costs include training (approximately $1M), operational overhead (20% of staff time in year one), and ongoing policy tuning. ROI typically hits in year two, not year one. Don’t budget for a one-time deployment. Budget for a program.
Identity First: Why CISA and NIST Both Make It Non-Negotiable
There’s no debate in the standards community about where to start. The CISA Zero Trust Maturity Model v2.0 centers identity as the primary pillar. NIST SP 800-207 lists user verification as pillar one. OMB’s federal zero trust strategy mandates identity-first implementation for all federal civilian agencies.
“Identity-first is non-negotiable. Without it, zero trust collapses under insider threats.”
Jen Easterly, Director, CISA
The logic is straightforward. Every zero trust policy decision depends on a verified identity. Without a reliable identity fabric, dynamic policy enforcement is impossible. You end up with static rules that approximate zero trust but don’t actually achieve it.
Deploy MFA across all user accounts, no exceptions, before touching network architecture
Move from role-based access control to policy-based access control (PBAC) for dynamic, context-aware decisions
Integrate behavioral analytics to detect anomalous access patterns in real time
Establish automated joiner/mover/leaver workflows so identity hygiene doesn’t decay
Connect IAM to device management so identity and posture are evaluated together at every access request
Per Okta’s State of Zero Trust Security data, more than 70% of hacking-related breaches involve stolen or compromised credentials. MFA combined with policy-based access controls is the single highest-impact control an enterprise can deploy in year one.
AI Agents and Zero Trust: The New Frontier Nobody Has Figured Out Yet
Most zero trust guides ignore this. They shouldn’t. AI agents now operate autonomously inside enterprise environments, calling APIs, reading data stores, and executing code, often without meaningful access controls applied to them. The attack surface implications are severe.
Per MITRE’s AI security research, agents deployed without zero trust controls dramatically expand enterprise attack surface. The specific vulnerability? Static access policies. Agents are dynamic by nature. They need to access different resources at different times based on task context. A static “this agent can read database X” policy doesn’t account for that dynamism and either over-privileges or under-privileges the agent’s actual access needs.
The MITRE ATT&CK framework specifically flags prompt injection as a zero trust gap, where an attacker manipulates an agent’s context to escalate access or exfiltrate data within the bounds of the agent’s legitimate identity. This isn’t theoretical. It’s already appearing in post-incident reports.
What does zero trust for AI agents look like in practice? Three emerging patterns:
1
Ephemeral Identity Tokens
Assign each agent task a short-lived identity with scoped permissions, rather than a persistent agent identity. This limits the blast radius of any single credential compromise and kills lateral movement from compromised agents.
2
Behavioral Baselines for Agents
Treat agent behavior like user behavior. Log every API call, data access, and tool invocation. Anomaly detection applies equally to human and non-human identities. Deviations from baseline should trigger the same response playbooks as user anomalies.
3
Human-in-the-Loop for High-Privilege Actions
Any agent action that touches sensitive data or executes infrastructure changes should require real-time human confirmation. This is a policy control, not a technology one, and it applies regardless of how much you trust the agent model.
The zero trust vendor ecosystem hasn’t caught up yet. Purpose-built agent security tooling is sparse. Enterprises deploying AI agents today are largely extending their existing IAM and observability stacks by hand. The gap won’t close until 2027 at the earliest, which means organizations need to architect for agent zero trust now, not wait for vendors to solve it.
Frequently Asked Questions
What are the 7 pillars of zero trust?
Per NIST SP 800-207, the seven pillars are: user (verify explicitly via MFA and behavioral analytics), device (posture and patch compliance), network/environment (microsegmentation and encryption), application/service (API gateway controls), data (classification and least privilege), visibility/analytics (continuous logging and threat hunting), and automation/orchestration (policy as code and dynamic response). Each pillar assumes breach by default and enforces least-privilege access dynamically.
How do you implement zero trust architecture?
Start with identity, not network. Modernize your IAM stack first, enforce MFA everywhere, then move to microsegmentation of high-value workloads, then expand to apps and data. Don’t try to secure everything at once. Use the CISA Zero Trust Maturity Model to benchmark each phase and confirm you’re progressing before expanding scope.
What is the zero trust implementation roadmap?
The standard enterprise roadmap runs 12 months across four phases: assess and inventory (months 1–3), identity fabric and microsegmentation (months 4–6), apps and data (months 7–9), automation and maturity audit (months 10–12). Zscaler’s zero trust research shows organizations following phased sequencing achieve significantly faster breach containment than those using big-bang deployment approaches.
What are the challenges of zero trust implementation?
The three most common are over-scoping (65% of failures), poor identity management (40% of failures per Gartner Peer Insights), and legacy system integration. The mitigation is phased implementation starting with identity, following NIST’s iterative pillar approach. Don’t try to solve everything in year one.
How long does zero trust implementation take?
12 to 18 months for full enterprise deployment, based on IDC research across 200 enterprises. Identity pilots can show measurable results in six months. Full automation and maturity at CISA Advanced stage typically takes 12 months with correct sequencing. Organizations that scope too broadly regularly stretch this to 24 months without reaching meaningful coverage thresholds.
What is the zero trust maturity model?
The CISA Zero Trust Maturity Model v2.0 defines four stages: Traditional, Initial, Advanced, and Optimal. Maturity is measured across five pillars (Identity, Devices, Networks, Applications and Workloads, Data) plus three cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance. Most enterprises begin at Traditional. A realistic 12-month target is reaching Advanced.
Is zero trust architecture expensive?
Initial investment runs 2–5% of IT budget, which for a mid-size enterprise is $5M or more including tooling, training, and staff time. But IBM’s breach cost analysis shows 50% reduction in breach impact for zero trust adopters. Zero trust costs more upfront than doing nothing. It costs significantly less than a major breach, and ROI typically materializes in year two.
What tools are needed for zero trust?
Core stack: IAM platform (Okta, Ping, Azure AD), ZTNA solution (Zscaler, Cato, Cloudflare), microsegmentation (Illumio), SIEM (Splunk, Elastic, Microsoft Sentinel), and SOAR for automation. The Forrester Wave: Zero Trust Platforms Q3 2025 provides independent vendor evaluation across categories.
Zero Trust Isn’t a Destination. It’s an Operating Model.
The pattern across hundreds of zero trust deployments is consistent: organizations that succeed treat this as a sequenced architectural transformation, not a technology procurement exercise. They start with identity. They scope to their highest-risk assets first. They measure constantly. And they don’t try to automate what they haven’t yet secured manually.
The organizations still operating without zero trust in 2026 aren’t behind because the technology isn’t ready. They’re behind because enterprise-scale security transformations are operationally hard, politically complex, and easy to defer. The Cisco data is unambiguous: 82% of organizations already live in hybrid and multi-cloud environments where perimeter security is architecturally obsolete. The question isn’t whether a zero trust implementation guide applies to your environment. It already does.
Three developments to watch through 2027: vendor consolidation in the ZTNA and microsegmentation categories will reduce integration complexity and lower entry costs. AI agent security will emerge as the next major zero trust frontier, with dedicated tooling from IAM vendors likely shipping in late 2026. And regulatory pressure will intensify, with federal mandates creating downstream pressure on government contractors and critical infrastructure operators. Organizations that finish their zero trust roadmap now won’t need to scramble when those pressures arrive.
About NeuralWired
NeuralWired is a Tier 1 technology publication delivering research-backed analysis for professional decision-makers. We serve technologists, C-suite executives, founders, investors, and policy professionals who need rigorous, source-verified coverage of enterprise technology, AI, and cybersecurity. Our editorial standard is simple: every major claim is sourced, every expert is fully attributed, and every framework is tested against real-world deployment data. NeuralWired is editorially independent and does not accept sponsored content or advertiser influence over its editorial decisions.
Editorial Standards
Articles are reviewed against primary sources before publication. Statistics cited in this piece are drawn from Forrester, IBM, NIST, CISA, Illumio, Okta, and Zscaler research published between late 2024 and early 2026. We update evergreen analysis when materially new data becomes available. Readers are encouraged to follow embedded source links to verify figures independently and review original methodology documentation before making organizational decisions based on this content.
Disclaimer
For informational purposes only. Statistics reflect third-party research as of March 26, 2026 and are subject to change. Vendor references are illustrative examples, not endorsements. Consult qualified security professionals before making architecture or procurement decisions. NeuralWired has no commercial relationship with any vendor mentioned herein.
Trump’s 2026 Cyber Strategy: Offense First, Details Later | NeuralWiredNeuralWired
Deep analysis for frontier technology professionals
National Security · Cybersecurity Policy
Trump’s Cyber Strategy: Offense First, Details Later
A 7-page doctrine pivoting the US to aggressive, AI-powered cyber operations, released the same day China allegedly walked out of the FBI’s network.
NeuralWired Staff|March 7, 2026|~ · 10 min read
On March 6, 2026, the White House published its long-awaited national cyber strategy. That same day, the Wall Street Journal reported that suspected Chinese state hackers had breached an FBI surveillance network, detected weeks earlier on February 17. The juxtaposition was hard to miss.
Whether coincidental or orchestrated, the timing underscored the document’s central argument: the US has spent years playing defense, and it’s losing. The Trump administration’s answer is a seven-page strategy built around six pillars, the most prominent of which is a push toward offensive cyber operations and the explicit “unleashing” of the private sector to join in.
The strategy and a companion executive order on cybercrime dropped within hours of each other. For CISOs, CTOs, and enterprise security teams, the combined package represents a meaningful shift in the US threat posture, though exactly how meaningful depends on implementation details that don’t yet exist.
6Policy pillars in the strategy
$15BStolen funds seized from scammers (cited in strategy)
$12.5BUS fraud losses in 2024 per FTC data
Feb 17Date FBI detected abnormal network activity
The Six Pillars: What’s Actually New
The strategy document organizes US cyber priorities into six areas. What’s notable isn’t just which pillars appear. It’s the ordering and emphasis.
01
Deter & Defeat Adversaries
Offensive operations against hostile actors; private sector incentives to disrupt threat networks.
02
Strengthen Federal Networks
Zero-trust architecture mandates and post-quantum encryption across government systems.
03
Protect Critical Infrastructure
Energy, finance, and data centers; partnership with sector-specific agencies.
04
Combat Cybercrime & Fraud
DOJ/State coordination on sanctions; dismantling fraud networks targeting US citizens.
05
Achieve Tech Superiority
AI supply chains, semiconductor security, agentic AI tools for defense.
06
Build the Cyber Workforce
Federal talent pipelines and private-sector alignment on security skills.
Prior administrations typically buried deterrence language deep in strategy documents, treating it as a diplomatic afterthought. This one leads with it. CSO Online noted the explicit elevation immediately.
“By moving the usual ‘deterrence’ part to the top and focusing on offense, which is usually only lightly referred to in past unclassified strategies, the administration has greatly emphasized that pillar.”
Ari Schwartz, Managing Director, Cybersecurity Services & Policy, Venable LLP; former White House cybersecurity director
Schwartz’s read matters because he has worked across multiple administrations and understands the difference between rhetorical posturing and doctrinal change. Putting offense first in an unclassified strategy sends a signal to adversaries, allies, and the private sector: the default posture is no longer “detect and respond.” It’s “find and disrupt.”
The same day the strategy published, the WSJ reported that Chinese state-affiliated hackers had compromised an FBI surveillance network holding domestic monitoring data. The FBI had detected abnormal log activity on February 17; Congress was notified in the days before the story broke.
White House releases 7-page “Cyber Strategy for America” and companion executive order on cybercrime and fraud.
March 6, 2026
WSJ reports suspected Chinese state actors behind FBI breach. NSA and CISA join FBI in remediation.
March 7, 2026 (ongoing)
Agencies actively remediating breach; scope and full severity still being assessed.
The breach remains at an early investigative stage. Reuters confirmed the hack was described as sophisticated, but the full scope is unknown. NSA and CISA are assisting the FBI. Critically, the compromised system was unclassified, which means procedures designed to protect classified networks weren’t the attack surface here.
For enterprise security teams, that’s the uncomfortable lesson: classified-tier controls can coexist with a breach of workaday, unclassified infrastructure. The FBI’s surveillance network contained data on domestic monitoring orders. Sensitive, not formally classified. That gap between “sensitive” and “classified” is exactly where adversaries operate.
The strategy’s Pillar 1, focused on deterring adversaries through offensive pressure and private-sector disruption, is directly relevant here. If the doctrine had been operational, the question isn’t just “how did China get in?” but “what proactive steps could have disrupted the operation before February 17?”
The AI and Technology Superiority Pillar: What CISOs Actually Need to Do
Pillar 5 is where the strategy intersects most concretely with enterprise security budgets. The document mandates attention to AI supply chains, semiconductor provenance, and the deployment of agentic AI tools for cyber defense. The language is high-level. This is a strategy document, not a technical specification. But the direction is clear.
Per the analysis from CSO Online, the strategy calls for secure AI stacks and data centers as a national security matter, not just a commercial preference. That has procurement implications for any enterprise with federal contracts or critical infrastructure designations.
The deregulation emphasis runs through the technology pillar. The administration argues that regulatory overhead has slowed AI innovation in the security domain, giving adversaries room to advance. Whether that argument holds is debatable. Several security researchers have noted that lax regulation is also how vulnerabilities proliferate. Expect procurement and compliance teams to get questions about it from leadership.
The zero-trust and post-quantum requirements in Pillar 2 apply specifically to federal networks, but they function as de facto standards for any organization doing business with the federal government. If your network connects to a federal agency’s network, their zero-trust posture becomes your concern.
The Fraud Executive Order: A Separate But Connected Track
The companion executive order on cybercrime and fraud operates on a different track from the national security pillars, but the two documents reinforce each other.
The EO directs DOJ and the State Department to coordinate sanctions against jurisdictions that harbor fraud operations and to develop mechanisms for returning seized funds to victims. The administration cited FTC data showing $12.5 billion in US fraud losses during 2024, a figure that represented 38% of fraud reports resulting in financial loss, up from 27% the prior year. The strategy also cited $15 billion in stolen funds already seized under previous Trump administration operations.
For financial institutions and payment processors, the EO signals increased federal coordination on fraud networks, which means more information sharing requests, more potential for joint operations, and more compliance touchpoints. For investors in cybersecurity companies focused on fraud detection, the policy tailwind is meaningful.
What’s Missing, and Why That Matters
The strategy’s critics are not wrong. Seven pages is light for a document meant to govern US cyber posture across the federal government, critical infrastructure, and private sector. Cybersecurity Dive flagged the gap between the document’s ambitious rhetoric and its thin implementation details. IST experts offered a pointed assessment of the infrastructure pillar specifically.
“The 2026 Cyber Strategy includes critical infrastructure security, but falls short on the specific support” for state, local, tribal, and territorial governments.
Institute for Security and Technology (IST) Expert Analysis, March 2026
The SLTT gap is significant. Critical infrastructure (water treatment plants, local power grids, small municipal systems) is overwhelmingly operated by entities that lack federal resources and often lack dedicated security staff. A national strategy that focuses on offensive capabilities and federal network hardening without a corresponding plan for SLTT support leaves the most vulnerable nodes exposed.
The administration has indicated that follow-on implementation plans are imminent. Watch for agency-level action plans in Q2 2026 that will fill in operational details. The strategy document is a declaration of direction; the action plans will determine whether it’s achievable.
The CISO Playbook: Translating 6 Pillars Into Action
The coverage gap across every competitor who’s covered this story is the same: they describe the pillars but don’t translate them. Here’s what each pillar actually demands from enterprise security teams right now.
Pillar 1 (Offense/Deterrence): Review your threat intelligence partnerships and ISACs. Understand what “private sector incentives to disrupt adversary networks” means for your legal exposure before your vendor pitches you on offensive tools.
Pillar 2 (Federal Networks): If you have federal contracts, audit your zero-trust maturity against NIST SP 800-207. Post-quantum migration timelines are no longer theoretical. Begin inventory of cryptographic dependencies.
Pillar 3 (Critical Infrastructure): Energy, finance, healthcare, and data center operators: expect tightened sector-specific requirements in Q2-Q3 2026. Map your current controls to CISA frameworks now.
Pillar 4 (Cybercrime/Fraud): Financial institutions should anticipate increased federal coordination requests on fraud networks. Review information-sharing agreements and ensure your legal team understands the EO’s victim-fund return mechanisms.
Pillar 5 (AI/Tech Superiority): Conduct an AI supply chain audit. Identify any AI tools or model providers with provenance questions. Chinese-origin AI components in federal-adjacent infrastructure will draw scrutiny.
Pillar 6 (Workforce): The talent gap the strategy acknowledges is real. Review compensation benchmarks for security roles. Federal competition for talent will intensify.
The pattern here is legible even before the implementation details arrive: the US is shifting from a fundamentally reactive cyber posture to a proactive one, and it’s betting that offensive deterrence, combined with AI-enabled defense, is more effective than the decade-long experiment in graduated response and international norm-building.
That bet carries real risks. Escalation dynamics in cyberspace are not well-modeled. The FBI breach, allegedly Chinese-linked, arriving simultaneously with a strategy that promises more aggressive retaliation raises the obvious question of sequencing: is this a response to China’s behavior, or will it provoke more of it? The answer is probably both, which is the uncomfortable arithmetic at the center of any offensive doctrine.
Watch for three developments in the next 90 days: (1) agency-level implementation plans that will reveal whether the strategy has operational teeth or remains aspirational, (2) the full scope of the FBI breach assessment, which will test whether Pillar 1 gets resourced in proportion to the threat it’s meant to address, and (3) the first private-sector partnership announcements under the offensive operations pillar, which will define exactly what “unleashing” the private sector means in practice. The organizations and CISOs that align their security postures now, before those details land, will have less catching up to do when implementation moves from strategy to mandate.
