U.S. Officials Consider Three-Day Patch Rule in Wake of Anthropic’s Mythos

Federal officials are considering reducing the remediation window for actively exploited vulnerabilities from two weeks to three days in response to Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber — AI models that can quickly find and help exploit software flaws. The report outlines government concern, limited unauthorized access reports, structural challenges for rapid patching (legacy systems, testing, change management), and recommendations to complement patching with containment, microsegmentation, and automation.