A flaw that went unnoticed for 27 years in OpenBSD, uncovered in a week by an artificial intelligence model: this is the starting point of a commentary published on 30 April 2026 by digitalswitzerland. Its author, Christophe Nicolas, Group CIO of the Kudelski Group and a member of digitalswitzerland's executive committee, draws a precise reading from it for Switzerland: in his view, the country's critical infrastructures were not designed for such an adversary. This is an opinion piece: the points below are those he reports and defends.
What the author reports
According to the commentary, an AI model named Claude Mythos, developed by the company Anthropic, found a vulnerability in the OpenBSD operating system that decades of human review had failed to spot. Still according to the author, the model also identified flaws in every major operating system and web browser, and built a working targeted attack for each one. The engineer using it had, he writes, no security training; a single instruction was apparently enough: find a vulnerability.
Christophe Nicolas states that Anthropic chose not to release the model publicly and to restrict access to a US consortium called “Project Glasswing”, which brings together Microsoft, Google, AWS, NVIDIA, JPMorgan and CrowdStrike. He stresses that Switzerland was not invited.
The reasoning: an assumption that collapses
For thirty years, he explains, cybersecurity rested on a simple idea: serious vulnerabilities are rare because they are hard to find. Patch cycles have always been slow, but this remained tolerable as long as attackers were slow too.
If an AI takes over the hard part, that is, searching for flaws at machine speed, in parallel, across all sensitive or strategic code, this balance breaks down. This is the core of his analysis: the pace of updates would no longer match the pace of possible attacks.
Switzerland's three pillars as seen by the author
Christophe Nicolas then re-examines three of the country's traditional strengths:
- Trust: it rests, in his view, on systems that rank among the most attractive targets in Europe.
- Neutrality: it places Switzerland, he writes, in the position of a country that applies the decisions of initiatives such as Project Glasswing without taking part in the discussions. In other words, Switzerland would see the threat without being handed the defence manual.
- Meticulous engineering: infrastructures are considered robust because they have been for decades; experience alone will probably no longer be enough, he believes.
He explicitly names Swiss Post, SBB, the federal administration, cantonal healthcare systems, the electricity grid and private wealth management platforms. In his eyes, none of these systems was designed to face an adversary capable of finding a decade-old flaw in a week. Among academics and policymakers, the dominant instinct is reportedly to accelerate, a relevant avenue but one that has yet to translate into concrete action, according to him.
His proposal: security at the hardware level
For the author, software updates will no longer be enough. He proposes building security directly into hardware:
- systems able to prove their identity and integrity through elements embedded at the core of the chips;
- sensitive actions systematically signed, so that no important operation goes unnoticed;
- encryption methods designed to withstand tomorrow's computers, including quantum ones;
- secure enclaves in processors, able to lock down cleanly when something goes wrong rather than letting data leak.
He notes that these technologies already exist and that Switzerland has the skills to develop them. Implementing them, however, is in his view a strategic choice rather than a simple purchase: treating cybersecurity as a pillar of sovereignty, on a par with neutrality, a capability that Switzerland must master itself.
Three targeted messages
To business leaders, he suggests a simple question: can their critical systems prove that they are trustworthy and trace every sensitive action? If the answer remains “we follow the patch schedule”, their strategy is already lagging behind, he argues.
To members of parliament, he points out that in November 2023 Switzerland opted for a sectoral approach to AI, consistent at the time but in his eyes insufficient today. He calls for a coordinated response during the current legislative term, failing which Switzerland would risk following decisions taken in Brussels rather than helping to shape them. Finally, to everyone, he asserts that in 2026 sovereignty also depends on the ability to understand, verify and master the security foundations of systems.
Key takeaways
The text combines reported facts about Claude Mythos, which the commentary does not detail on a technical level (the OpenBSD flaw is not described, for example), with a personal analysis of Switzerland's position. It states that the opinions expressed are the author's own and do not necessarily reflect those of digitalswitzerland; Christophe Nicolas also says he wrote with the support of Claude Opus 4.7 for suggestions and proofreading. His central observation, the gap between the speed at which flaws are detected and the speed at which they are patched, raises questions for infrastructure operators; his remedies are a political choice that has yet to be debated.
