#The AI Vulnerability Storm Is Here - How Honeypot Threat Intelligence Catches Zero-Days Before Disclosure

The CSA’s Mythos briefing tells CISOs to prepare. We already caught CVE-2026-35616 and CVE-2026-21643 using the approach they’re describing.

---

The Cloud Security Alliance just published an emergency strategy briefing on what it calls the “AI vulnerability storm” - the expected surge in AI-discovered exploits triggered by capabilities like Anthropic’s Claude Mythos. The paper, assembled in 72 hours by 60+ contributors including Jen Easterly, Bruce Schneier, and Chris Inglis, lays out a new reality for vulnerability management: exploit discovery costs are dropping, the window between disclosure and weaponization is compressing toward zero, and capabilities that required nation-state resources are becoming widely accessible.

The briefing calls on CISOs to build “Mythos-ready” security programs. One of the central recommendations is adopting AI-augmented defensive tooling that can match the speed of AI-augmented offense.

We’ve been operating in this model for months. Here’s what it looks like in practice.

#A FortiClient EMS zero-day, caught by honeypot telemetry

On March 31, our globally distributed honeypot sensors detected novel exploitation attempts against FortiClient EMS decoys. The traffic didn’t match any known CVE. No advisory existed. No patch was available. Our Radar analysis pipeline flagged the activity as a previously unseen pre-authentication API bypass - what would later become CVE-2026-35616, a CVSS 9.8 improper access control flaw enabling unauthenticated remote code execution.

We reported the zero-day to Fortinet under responsible disclosure. They issued an emergency hotfix over the Easter weekend. CISA added it to the KEV catalog on April 6 with a remediation deadline of April 9. At the time, Shadowserver identified roughly 2,000 exposed FortiClient EMS instances - most in the US and Germany.

This followed CVE-2026-21643, a critical SQL injection in the same product line that we also detected through our sensor network weeks earlier as an N-day exploit. Two unauthenticated critical vulnerabilities in one product, both caught through honeypot-based anomaly detection before they hit mainstream threat feeds.

#The pre-disclosure intelligence gap

The CSA report frames the problem clearly: AI-driven vulnerability discovery compresses timelines that defenders relied on. Patch-diffing gets faster. Exploit chains get assembled in hours instead of weeks. Every patch release becomes a roadmap for the next attack.

Traditional threat intelligence operates on known indicators - published CVEs, shared IOCs, vendor advisories. That model assumes a window between discovery and exploitation where defenders can react. The AI vulnerability storm shrinks that window, and in zero-day scenarios, it doesn’t exist at all.

CVE-2026-35616 is a concrete example. Organizations relying on conventional intel feeds had no signal until Fortinet published the advisory on April 4. Attackers had been probing since at least March 31.

#How Defused Radar provides pre-disclosure exploit detection

Radar works by deploying high-fidelity honeypot decoys that emulate real enterprise attack surfaces - FortiClient EMS, Citrix NetScaler, Cisco SD-WAN, BeyondTrust, SolarWinds, Ivanti, Juniper, and others - across AWS, Azure, and OVH. When attackers interact with these decoys, we capture the full session: payloads, behavioral patterns, PCAP, and forensic chain data.

The Radar pipeline then analyzes inbound exploit traffic for novel paths - attack behavior that doesn’t match any cataloged vulnerability or known technique. This is zero-day threat intelligence derived from live attacker behavior, not retroactive analysis of disclosed flaws.

For subscribers, this surfaces as actionable alerts with context: what’s being targeted, how the exploit works, and what the exposure looks like - delivered while exploitation is still in its early stages.

#Practical application for Mythos-ready security programs

The CSA briefing recommends accelerated patching cadences, increased incident response capacity, and AI-augmented defensive tooling. Those are necessary. But they share a dependency: you need to know what’s coming.

Honeypot-based threat intelligence addresses the detection layer that sits upstream of all three. It’s the difference between patching reactively after an advisory drops and knowing that a specific product is under active zero-day exploitation before the vendor has published anything.

That’s what Radar delivered with CVE-2026-35616 and CVE-2026-21643. Not in theory - in production, with responsible disclosure, CISA KEV inclusion, and emergency vendor response as the outcome.

The AI exploit storm will produce more of these. The organizations with forward-deployed sensors watching attacker behavior in real time will see them first.

---

#Frequently asked questions

#What is the AI vulnerability storm?

The AI vulnerability storm refers to the expected surge in vulnerability discoveries and exploits driven by AI models like Anthropic’s Claude Mythos that can autonomously find and exploit software flaws at scale. The Cloud Security Alliance published a strategy briefing in April 2026 warning CISOs to prepare for compressed exploit timelines and a higher volume of zero-day attacks.

#What does “Mythos-ready” security mean?

Mythos-ready security is a term from the CSA briefing describing security programs adapted for an era where AI can discover and weaponize vulnerabilities faster than traditional patch cycles can respond. It includes AI-augmented defense tooling, accelerated patching, and pre-disclosure threat intelligence capabilities.

#How does honeypot-based threat intelligence detect zero-days?

Honeypot-based threat intelligence uses decoy systems that mimic real enterprise infrastructure to attract and capture attacker activity. When attackers target these decoys with novel exploits - exploit behavior that doesn’t match known CVEs - the honeypot operator can identify zero-day exploitation before vendors or traditional threat feeds have any signal. Defused Radar detected CVE-2026-35616 (FortiClient EMS) this way on March 31, 2026, days before Fortinet’s April 4 advisory.

#What is pre-disclosure exploit detection?

Pre-disclosure exploit detection is the identification of active exploitation targeting a vulnerability before the affected vendor has published an advisory or patch. It requires observing attacker behavior directly rather than relying on published indicators. Defused’s honeypot sensor network provides this capability by capturing novel exploit traffic across globally distributed decoys.

#How did Defused discover CVE-2026-35616?

Defused’s honeypot infrastructure detected exploitation attempts against FortiClient EMS decoys starting March 31, 2026. The Radar analysis pipeline identified the traffic as a novel pre-authentication API bypass that didn’t match any known vulnerability. Defused reported the finding to Fortinet under responsible disclosure. Fortinet confirmed active exploitation and issued an emergency hotfix. CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities catalog on April 6.

---

Defused is a honeypot-as-a-service threat intelligence platform delivering pre-disclosure exploit detection through globally distributed sensor infrastructure. Defused Radar identified CVE-2026-35616 as an active zero-day before vendor disclosure. Learn more at console.defusedcyber.com