Stopping frontier AI at the wire: Why inline control Is a core advantage against Mythos-class models

Abbas KudratiField CISO for APCJ | F5

Anthropic's Claude Mythos, currently restricted to a small number of trusted organizations under Project Glasswing because of its advanced cybersecurity capabilities, represents something fundamentally different from previous generations of AI.

Frontier AI's risk has little to do with malicious intent; it comes from the model's capacity to reason, plan, adapt, and optimize in real time. Whether operating autonomously or through a compromised integration, a Mythos-class model can generate highly convincing social engineering campaigns, probe APIs at machine speed, continuously test security controls, and immediately change tactics when it encounters resistance.

That changes the economics of cyber defense.

Most enterprise security architectures were designed to stop attackers who follow recognizable patterns. Signature-based detection, predefined policies, and human investigation have served organizations well because human attackers inevitably leave time between reconnaissance, exploitation, and adaptation.

A reasoning model removes that advantage. When an AI agent can observe, learn, and change its behavior within seconds, security teams no longer have the luxury of responding after detection. Where you intercept the attack now matters more than whether you detect it.

The answer lies in the traffic path. Every prompt, every API call, every Model Context Protocol (MCP) request, and every tool invocation must traverse the application delivery layer before reaching anything of value. Regardless of how intelligent an AI model becomes, it cannot bypass the network. That is the one control point the adversary cannot avoid.

Understanding three very different control models

One of the biggest sources of confusion in today's AI security market is the interchangeable use of terms like real-time, runtime and inline. They are not the same thing, and the distinction matters. So what are the differences?

Real-time controls (visibility & post-action alerting): Real-time controls detect suspicious activity as it occurs and generate alerts within seconds or minutes. They provide visibility but generally rely on another system—or a human analyst—to take action.

Imagine an AI agent aggressively querying a customer database API at 2:47 a.m. Your SIEM correctly identifies abnormal behavior and immediately creates an incident.

The alert is accurate. The timing is excellent. Unfortunately, by the time an analyst reviews the ticket, the AI has already completed its reconnaissance and moved on. Detection without enforcement records an attack rather than stopping one.

Runtime controls (execution-level guardrails): Runtime controls actively enforce policies while an application, endpoint, or agent is executing.

This represents a significant improvement over detection alone because action is taken automatically. However, runtime protection is still constrained by predefined policies and by what that specific runtime environment can observe.

Suppose an endpoint agent blocks a suspicious system call from a local AI assistant. The model analyzes the failure, identifies another execution path that wasn't anticipated by policy, and achieves the same objective through a different technique.

Runtime protection works extremely well against expected behavior. Reasoning models are specifically designed to produce unexpected behavior.

Inline network and application controls (traffic-path interception): Inline controls operate at an entirely different layer. Instead of waiting for an application or endpoint to make a decision, inline enforcement sits directly in the traffic path, inspecting every request before it reaches the inference engine, API, application, or downstream service.

Consider a Mythos-class model attempting a sophisticated multi-stage prompt injection designed to extract training data through indirect reasoning.

There may be no known signature, no previous example, no historical IOC to match against. Yet the request can still be inspected, evaluated and blocked before it ever reaches the model—or before unsafe output reaches the user.

That distinction is critical: inline security stops the request from completing in the first place, rather than responding once compromise has already happened.

Why frontier AI breaks traditional security assumptions

Historically, defenders benefited from one important advantage: time. Even highly skilled attackers required hours or days to move through reconnaissance, exploitation, and privilege escalation. Security teams could detect suspicious activity, investigate, update signatures, and strengthen controls before significant damage occurred.

Frontier AI compresses that timeline dramatically. Within a single session, an adversarial AI agent can:

• Discover exposed, shadow and unmanaged APIs.
• Generate thousands of prompt variations to identify weak guardrails.
• Determine which responses indicate genuine enforcement versus simple filtering.
• Instantly change techniques, encodings and payload structures.
• Exfiltrate sensitive information through seemingly legitimate output channels.

What previously required an experienced red team several days can now happen within minutes. This is why architectures dependent on human intervention become increasingly ineffective. If protection depends on an analyst reviewing alerts, updating signatures, or manually modifying policies, the attacker has already completed multiple iterations before the first response begins.

Against reasoning AI, enforcement must happen at wire speed.

The architecture this requires

Meeting reasoning AI at the wire calls for a different design point than most security stacks were built around.

Control needs to sit across the entire application delivery path as a single surface, rather than being split between isolated point products. Inspection has to happen at the inference layer itself, so prompts and responses are analyzed in real time before either reaches a person or a model. API discovery has to run continuously, because managed inventories rarely capture the unmanaged and shadow APIs that autonomous agents look for first.

Testing against attacker techniques has to be continuous rather than periodic, and the findings need to feed directly back into enforcement—otherwise protection updates on a policy cycle measured in weeks, while the adversary iterates in minutes. AI agents also need to be recognized as a distinct category of identity, separate from human users and conventional bots, so that agent-to-tool traffic, including MCP exchanges, receives the same governance as user authentication.

None of this works as a collection of disconnected tools. It has to operate as one enforcement architecture spanning APIs, inference traffic, agent identity, and application security, under a common policy framework across hybrid and multicloud environments.

Why this matters as AI continues to evolve

Today's discussion often focuses on prompt injection. Tomorrow's challenge will be autonomous systems orchestrating thousands of API calls, invoking tools, and collaborating with other agents largely without human intervention—and organizations will see a corresponding surge in machine-generated traffic.

Each of those interactions is another enforcement decision. Protecting isolated layers—a prompt filter here, an API gateway there, a bot detector somewhere else—creates architectural seams, and seams are exactly where reasoning AI will look first. The more capable the adversary becomes, the more architectural consistency matters.

The strategic imperative for CISOs

Frontier AI is changing the nature of cyber defense. As autonomous models become deeply integrated into enterprise applications, APIs, and business workflows, the traffic path becomes the single most important enforcement surface under your control—every prompt, every API call, every MCP exchange, and every autonomous tool invocation passes through it.

Real-time controls tell you what already happened. Runtime controls stop what policy anticipated. Inline controls stop what's happening right now, before the request reaches its destination.

For CISOs, that is the architectural question that matters most.

For security leaders, the strategic mandate is clear: build your enterprise defense around the one structural layer an adversary cannot circumvent.

To learn more, visit our F5 Application Delivery and Security Platform webpage.

About the Author

Abbas KudratiField CISO for APCJ | F5

More blogs by Abbas Kudrati