# The 17-Year-Old Bug That Shocked the Security Industry, and the Infra Story Beneath It **Author:** WEKA **Published:** October 20, 2026 ![Distressed metal box under spotlight in dark industrial room with cracked floor and open shaft with cable.](https://cdn.sanity.io/images/ult5g8gw/production/21eaad92def4f4f0c537a9c222ec652918284c0d-1376x768.jpg) ## TL;DR Discover how AI agents exposed a decades-old flaw and why memory-efficient infrastructure is essential for sustained security at scale. - Sustain agent concurrency by balancing memory and compute. - Audit memory bottlenecks before adding GPUs. - Prepare blue swarms to outpace emerging threats. For 17 years, a remote code execution flaw hid within FreeBSD’s NFS remote code execution before [Anthropic’s Claude Mythos found it](https://www.forbes.com/sites/amirhusain/2026/04/01/ai-just-hacked-one-of-the-worlds-most-secure-operating-systems/). This exposed a major vulnerability in what security insiders widely consider to be one of the most secure platforms in the industry. Around the same time, [Mythos found zero-day vulnerabilities](https://venturebeat.com/security/mythos-detection-ceiling-security-teams-new-playbook) in some of the most popular operating systems and browsers, with one bug living as long as 27 years. Some of the best security researchers in the world had every opportunity to find the [flaw in FreeBSD’s CVE-2026-4747](https://www.anthropic.com/research/mythos-preview), but they never did. Then a powerful AI agent discovered it and built a working exploit in just hours. [Dan Nishball](https://www.linkedin.com/in/nishball/), Chief Operating Officer and Director of Research at [SemiAnalysis](https://www.linkedin.com/company/semianalysis/) recently spoke with WEKA’s [Val Bercovici](https://www.linkedin.com/in/valentinbercovici/), following a fireside chat on [tokenmaxxing](/video/compute-as-capital-redefining-ai-s-new-currency) for cybersecurity at [MTX - Milipol TechX](https://www.linkedin.com/company/mtx-milipoltechx/) in Singapore. They explored what actually made this discovery possible and why the story is as much about infrastructure as it is security. ### What infrastructure made a 17-year-old bug findable? Finding the vulnerability in CVE-2026-4747 didn’t involve a single query. It took sustained agent concurrency, reading, testing, and re-testing code paths long after a human reviewer would have moved on. This kind of workload runs straight into a constraint most teams don’t see coming until it’s too late. As Val and Dan described it on stage, “Once you load in model weights and you start having multiple user sessions, especially now with multiple agent sessions and subtasks, you’re just very quickly out of memory.” High-bandwidth memory (HBM) fills up, DRAM fills up, response times get worse, and total token output can actually drop just when you need it to keep climbing. The security breakthrough and the infrastructure bottleneck tell two sides of the same narrative: Exhaustive review at machine scale is only possible if the system underneath it can sustain the concurrency long enough to find what everyone else missed. The fix isn’t more GPUs. It’s balancing the system with more memory relative to compute and disaggregating memory from the GPU instead of stacking more accelerators onto the same crowded hardware. Done correctly, this produces steadier latency and token throughput that keeps scaling with swarm concurrency without a matching jump in hardware or energy spend. ### Why blue swarms vs. red swarms are the next enterprise workload [CrowdStrike](https://www.linkedin.com/company/crowdstrike/) CEO [George Kurtz](https://www.linkedin.com/in/georgekurtz/) emphasized [the urgency behind this shift](https://venturebeat.com/security/mythos-detection-ceiling-security-teams-new-playbook): “AI is creating the largest security demand driver since enterprises moved to the cloud.” This demand cuts both ways. If defense teams can field swarms of agents to review every line of code and every log, provided the infrastructure underneath can sustain it, attackers can field the same kind of swarm to probe every possible weakness. As Dan put it, “The only way to really keep up is to be aware of it and to potentially be able to outpace them.” Security stops being a headcount problem and becomes a question of whose swarm is better resourced and better engineered, end to end. ### What’s fueling this leap in agent capability? None of this was possible a year ago. There was almost no token demand from AI agents until Claude Code arrived around May 2025. Since then, adoption has climbed sharply because the returns are hard to dispute. As Dan described it, “Users are experiencing phenomenal ROI. They’re getting things done that would take 15 hours in 30 minutes.” This isn’t because fewer people are doing security work. It’s simply the same people covering far more ground at a pace no manual review process can match, provided the infrastructure running these agents can keep up with them. ### Why there isn’t enough memory to fuel this race This is a supply problem, not just an engineering issue. Currently, there isn't enough manufacturing capacity around the world to produce enough memory (whether it’s HBM, DRAM, or NVMe) to satisfy explosive token demand. Dan’s read on why prices have spiked: “The ROI is so good to end users that there is this lack of price elasticity, which has driven up prices of memory multiple-fold over the last year, which means we just have to be smarter.” The bad news is that [this trend is expected to persist and even worsen well into 2027](https://www.pcmag.com/news/2027-will-be-the-worst-year-in-history-for-memory-supply-says-sk-hynix). 👉 Read More: [Five Strategies for Surviving the Memory Shortage](/resource/surviving-the-nand-flash-shortage) We think of this as a version of a [“peak oil”](https://millardball.its.ucla.edu/wp-content/uploads/sites/22/2022/06/Brandt_2013_Peak_Demand_preprint.pdf) moment. When crude oil scarcity in the 1970s spiked gasoline prices, the auto industry didn’t come to a screeching halt. Instead, it forced [development and production of more efficient vehicles](https://autos.yahoo.com/classic-and-collector/articles/1970s-oil-crisis-reshaped-car-170055039.html?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAAEh0KJklTzDuD_LWvJiQHSWTfjgzYBgXW86mIu6GflrKN5IO57CXujs8nNutZh3YJyDwvhQOaJI2mBPb_Cq9CfrSmqZ6FCEPgoynOu0yIuPV7zEB1S3enZ-UJGDWtFjYi5L9HNY8hSnMmmGoCBxGr6ZBthoRVGgrO1rA3p5b2Glc). The same logic applies here: Memory isn’t getting cheaper or more abundant anytime soon, so the winning move is efficiency per token, not brute-force silicon. ### What should security leaders do now? Security teams would be shrewd to consider the underlying AI infrastructure as a critical component of defending against breaches that can severely impact business operations and reputation. Here are three things to think about: - **Treat agent swarms as a security workload first**,** not just a productivity gain**. If red swarms are coming for your environment, your blue swarms need to be operational before they hit. - **Audit for memory bottlenecks before adding GPUs.** Inconsistent latency and falling token output under concurrency are usually a memory problem dressed up as a compute problem. It’s also the same issue that determines whether your swarm can actually finish the review it started. - **Budget memory capacity as its own line item.** This should not be an afterthought to compute, given how tight and expensive the supply chain has become. The next arms race in enterprise security won’t be decided by who has more analysts, but rather by whose agent swarm can look in more places, sustain more concurrency, and keep producing tokens without the infrastructure underneath it buckling first. The bug in CVE-2026-4747 sat undetected for nearly two decades. As AI agents become ever more sophisticated, it’s unlikely the next big bug would go undetected for this long, and the teams whose infrastructure can go the distance will lead the pack. 👉 Want to dive deeper into why memory is the biggest hurdle blocking effective AI inference? Don’t miss this article, [“The AI Memory Wall: Why Inference Is Running Out of Memory (and What to Do About It)](/learn/ai-ml/ai-memory-wall/).”