By Autonomous AI models are now capable of scanning production software, identifying previously unknown vulnerabilities, and generating working exploits in minutes, without any prior knowledge of the target. A 27-year-old undetected flaw in open source software is no longer a theoretical risk. It is a confirmed data point from a live model run. For enterprises running Java at scale, the patching calculus has changed entirely.
In this interview on TFiR, Simon Ritter, Deputy CTO at Azul, breaks down how AI-driven vulnerability discovery is reshaping the Java security threat landscape and what the launch of Azul’s free JVM vulnerability risk assessment means for production Java estates.
Guest: Simon Ritter, Deputy CTO at Azul
Show: TFiR
Here is what every platform engineer and security team running Java in production needs to know.
Technical Deep Dive
Q: Why is autonomous AI changing the urgency around Java runtime security right now?
Simon Ritter, Deputy CTO at Azul, explains that the rapid growth of AI adoption has made cybersecurity far more urgent than the industry anticipated. Models developed by major AI labs now have demonstrated capabilities to scan software, identify vulnerabilities that have never been detected, and produce working exploits, all at a speed and scale that was not previously possible. Java, as one of the most widely deployed runtime environments, is directly in scope for these scanning operations.
“The threat landscape is changing. It’s changing a lot in terms of the perspective of thinking that we are going to see quite a lot of vulnerabilities being identified and having to be patched.” — Simon Ritter, Deputy CTO, Azul
Q: What is Anthropic’s Project Glasswing and what did it find?
Anthropic developed a model internally referred to as Mythos, which demonstrated powerful vulnerability detection and exploit generation capabilities. The project, called Project Glasswing, was kept largely under wraps due to its sensitivity. Ritter notes that Anthropic has stated the model was pointed at commonly used software, including every major operating system and web browser, and identified vulnerabilities across all of them. One of the oldest vulnerabilities it surfaced in an open source codebase was 27 years old, code that had been in production and undetected for nearly three decades.
“One of the oldest vulnerabilities that it detected in an open source piece of software was like 27 years old. That vulnerability hadn’t been detected in all that time.” — Simon Ritter, Deputy CTO, Azul
Q: How fast can an AI model generate a working exploit for a known Java vulnerability like Log4Shell?
Ritter described a test in which an AI model was pointed at the Log4J library without any prior knowledge of the Log4Shell vulnerability or the published exploit information. The model independently identified the vulnerability and produced a usable exploit. The total time from initial analysis to working exploit was 18 minutes and 53 seconds. This figure represents a concrete benchmark for how quickly autonomous models can operationalize an attack against Java library dependencies.
“From pointing it at a piece of software to having a usable exploit, 18 minutes and 53 seconds.” — Simon Ritter, Deputy CTO, Azul
Q: Is this threat limited to Anthropic’s models or are other AI providers catching up?
Ritter is clear that Mythos is not an isolated case. He points to OpenAI’s announcement of GPT-5.5 Cyber as evidence that multiple frontier AI providers are developing models with dedicated cybersecurity and exploit capabilities. The competitive dynamic means the availability of autonomous vulnerability discovery tools is expanding, not narrowing. Security teams cannot assume only one closed model poses this risk.
“It’s not just about Mythos. It’s about other models catching up.” — Simon Ritter, Deputy CTO, Azul
Q: What should enterprises expect in terms of vulnerability disclosure and patching volume over the next 12 to 24 months?
Ritter projects that the volume of newly identified vulnerabilities will increase significantly as AI models continue to scan widely deployed software. He frames the next 12 to 24 months as a critical window during which organizations running Java in production need to understand what is in their estate, what is exposed, and what the patching priority order should be. Understanding the threat landscape and acting on patching priorities for critical software is what he identifies as the core operational challenge ahead.
“Understanding that new threat landscape and what are the priorities when it comes to patching the critical software that you’ve got running in your estate is going to be very important.” — Simon Ritter, Deputy CTO, Azul
Q: What is Azul’s free JVM vulnerability risk assessment and what problem does it solve?
Azul launched a free JVM vulnerability risk assessment in direct response to the changing threat landscape described above. The assessment is designed to help organizations understand what vulnerabilities exist in their Java runtime environment before autonomous AI models or human attackers find and exploit them. It addresses the gap between the increasing speed of exploit generation and the typically slower pace of enterprise vulnerability discovery and remediation.
“The idea of cybersecurity has become very, very relevant because if you look at what these models can do, we can find many more vulnerabilities than we had before.” — Simon Ritter, Deputy CTO, Azul
Resources & Documentation
- Azul JVM Vulnerability Risk Assessment, free assessment tool to identify CVE exposure in your Java runtime environment
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: Azul just launched a free JVM vulnerability risk assessment. Before we get into what it is, what it does, can you help us understand the threat landscape that you are responding to, specifically how autonomous AI changes the urgency around Java runtime security?
Simon Ritter: Yes, I mean, as we’ve seen, the growth of AI and how much it’s being used has really kind of just taken everybody by surprise. I think that’s fair to say. And we’ve seen over the last few months that. But the idea of cybersecurity has become very, very relevant because if you look at Anthropic, who are one of the big companies behind the AI models, they announced what they called Mythos and Mythos was a new model for them which they had determined had very powerful cybersecurity detection, vulnerability detection and also exploit capabilities. And so they actually have kept it fairly under wraps. And there’s been a lot issues around the American government deciding that they don’t want people to access it, and various things like that that I won’t go into. But essentially the model that they’ve created now has capabilities which allows it to look at software and find vulnerabilities that haven’t been found before and do it in such a way that we can find many more than we had before. If you look at some of the statistics, I think one of the oldest vulnerabilities that it detected in an open source piece of software was like 27 years old. So the code that was responsible for that was like 27 years old. And that vulnerability hadn’t been detected in all that time. But in terms of the impact, it is huge because we can look at the fact that again, from what Anthropic have said, because they’re keeping it under wraps, they have this thing called Project Glasswing, they’re keeping it under wraps, but they have said that they’ve basically detected vulnerabilities in every operating system, every web browser. They pointed it at all the sort of commonly used pieces of software. Now Java from that perspective is also a very commonly used piece of software. And again, to sort of give you some idea of how important it is from a Java security perspective, one sort of data point, if you like, which is not specific to the Java runtime, but if we look at the libraries which also sit on top of Java, there’s an interesting statistic that I saw related to another language model. So not actually Mythos, but somebody used another one. And again, this is why it’s very important, because even today I’ve seen announcements about OpenAI. They’ve announced GPT 5.5 cyber. So it’s not just about Mythos, it’s about other models catching up. And specifically the article that I read said that they had pointed the model that they were using at certain things which were known vulnerabilities and ones that have been exploited in the past. And the one that kind of caught my eye was one that we’ve seen a few years ago, which was log 4 shell based on the log 4J library. And they basically took the model and they said, right, pointed at log 4J, which was the library, but without the information that had been published about the vulnerability. So it didn’t have any prior knowledge of that. And it went and it tried to see whether it could determine a vulnerability and whether it could create an exploit. And it did. Okay, so that’s very concerning. What’s even more concerning is the fact that it took 18 minutes and 53 seconds to do that. So from pointing it at a piece of software to having a usable exploit, 18 minutes and 53 seconds. So what is important is understanding that the threat landscape is changing. It’s changing a lot in terms of the perspective of thinking that we are going to see quite a lot of vulnerabilities being identified and having to be patched over. I would say the next year, 18 months, maybe two even longer years. And that’s going to be very important is understanding that new threat landscape and what are the priorities when it comes to patching the critical software that you’ve got running in your estate.
