Security is becoming an epidemiology problem

2026-04-11 · Matt Horn

An AI lab has announced Mythos, a model it is not releasing publicly. On the lab’s own accounting, Mythos discovers and exploits multi-step vulnerability chains across most major operating systems, browsers, and widely used infrastructure software. A chain strings several separate flaws together, none of them enough on its own. Some of the flaws it surfaced had gone unnoticed for 27 years. More than 50 organizations¹ are working through what it found, and Jerome Powell and Treasury Secretary Scott Bessent met with bank CEOs this week to discuss the implications.

The capability points in two directions. Released openly it would hand attackers a working toolkit against infrastructure most of the internet runs on. Routed to the vendors and maintainers who can ship a patch, the same capability behaves more like an inoculation: a measured exposure, given to the party able to respond to it.

We’ve borrowed the vocabulary for a long time already. Consumers call self-replicating malware a “virus,” many strains are polymorphic, rewriting their own code on the fly to evade detection, and a compromised machine gets quarantined. What the words have never bought us is the arithmetic. Zero-days, flaws with no patch available because the vendor doesn’t know or hasn’t shipped one, turn up constantly in the software everyone depends on, and staying current means a continuous drip of patches at every level of the stack. Miss them and a machine is exposed to exploits that are already public and packaged.

The exposure used to be bounded. In the 1980s a hospital ran on paper and filing cabinets, and a desktop computer was a novelty in most offices. Almost every significant financial transaction now happens digitally, in traditional banking and in cryptocurrency alike, so the reach of an intrusion is no longer limited by where the intruder is. Control of an organization, or of a government office, increasingly changes hands the way everything else does: through credentials.

Software now faces an adversary that adapts faster than the software does. Exposure in careful measure does harden it, though calling the result immunity flatters the mechanism. Nothing in the software learned; the adaptation happened when a human read a report and shipped a patch.

One risk is a less careful organization shipping the same capability with no controls on who runs it. The harder problem is allocation. There is always more patching to do than anyone can do, and no principled way to say which of it buys the most.

Epidemiology has a version of that answer, under an assumption that turns out to matter. If a population mixes at random, then past some fraction immunized each infection produces on average less than one further infection, and transmission dies out on its own. That fraction is the herd immunity threshold.

The mapping isn’t clean. Software doesn’t come in well-defined individuals the way animals do, and a patched server protects nobody but itself, which should be fatal; indirect protection is the entire mechanism herd immunity runs on.

The break is where it gets interesting. Patching OpenSSL upstream is not indirect protection: an unpatched server is exactly as exploitable however many of its peers updated, which is what Log4Shell’s multi-year tail looks like in practice. What moves through the dependency graph is the fix, not the immunity. Upstream is where the dose gets manufactured, and every downstream still has to take it. That reframes the question instead of killing it. Most of these attacks chain several vulnerabilities together, so the defender’s unit of work has always been the chain, and we have been counting bugs. Run the arithmetic over the links that chains reuse: rank them by how many chains need them, patch the top of that list, and coverage becomes something you can state, as the fraction of known chains missing a link.

That isn’t the same as patching the most popular library, which is what dependency scoring does. It is close to what attack-graph analysis has done since the late nineties, and adjacent to what EPSS and reachability analysis do now, which rank what is being exploited and what is actually callable. My guess is that the recurring links are primitives: the reusable building blocks a chain needs, like a sandbox escape. Popularity is a poor proxy for that. Close one primitive and every chain that needed it has to find another, which is a real cost to an attacker and a temporary one. A corpus of real chains is what would settle it. Corpora do exist, in CISA’s exploited-vulnerabilities catalogue, Project Zero’s in-the-wild tracker and the Pwn2Own writeups, but they are incident records: assembled after the fact, and biased toward the chains that got caught.

Which makes the threshold question the one worth answering, and it’s the one I can’t answer alone. An adversary re-targets where a pathogen only diffuses, and that cuts at the threshold itself: close a primitive, the attacker substitutes another, and whatever coverage you bought decays instead of holding. I don’t know how much of the epidemiological arithmetic survives that, or what to hand you as the host, the transmission event, or the infectious period. If you model infectious disease for a living and have an hour and an opinion, I’m at matt [at] matthorn [dot] io. Tell me which part of the analogy I’ve broken.

All posts · Home