AI closes vulnerability window as zero-day exploits surge

For years, security teams have assumed that some vulnerabilities stay hidden because they're too buried, too old, too proprietary or based on too obscure interactions for humans or traditional tools to find. AI is challenging that assumption.

Frontier models do more than match known vulnerability patterns or flag isolated coding mistakes. They now can reason across large codebases and with their huge context windows can follow dependencies between modules and libraries and connect weaknesses that might at first appear to be unrelated. 

Recent initiatives such as Anthropic's Project Glasswing and OpenAI's Daybreak demonstrate how frontier models can reason across complex software dependencies in ways conventional testing struggles to match. The research has shown AI uncovering flaws that survived years of manual review, static analysis and automated fuzzing. The consequences reach beyond vulnerability discovery. 

AI can compress the time between finding a flaw and turning it into a working attack. That changes how CISOs need to think about exposure, patching, prioritisation, and incident response. Most were aware the vulnerability window was closing, but as of July 2026, that window closed.

AI is redefining vulnerability discovery 

Traditional security testing has improved enormously. Static analysis, fuzzing and automated testing help teams find known coding mistakes, insecure configurations and common vulnerability patterns. They remain important parts of a modern security program. Their limits show up when exploitable conditions depend on sophisticated interactions of multiple, seemingly independent components. A missing validation check in one part of the system may seem harmless. An integer overflow handling or null pointer issue somewhere else may look low priority. A dependency between modules or services may not appear dangerous on its own. The real attack path appears when those pieces interact.

That is why the 27-year-old OpenBSD vulnerability discovered by a frontier AI model was so notable. OpenBSD is widely regarded as one of the world's most security-hardened operating systems. The flaw was not a single obvious mistake. It required connecting a missing lower-bound validation check with a signed integer overflow and a sequence of conditions that could trigger a crash with only two crafted packets.

A human researcher might see one piece of that chain and treat it as uninteresting. A fuzzer might hit the same area repeatedly without understanding the relationship between conditions. A frontier model can reason across the chain and identify how separate weaknesses combine into an exploit path. 

The same pattern showed up in the HTTP/2 Bomb research, where AI-assisted analysis helped connect older techniques into a remote denial-of-service issue affecting major web server and proxy technologies. AI can make old weaknesses dangerous by finding combinations that people and tools did not connect.

The rise of open-weight models

The industry tends to focus on frontier model size, but the surrounding system often matters just as much. A model may produce the insight, while the harness around it determines how the problem is broken down, what context is retrieved, how tests are run and how failures are evaluated.

That distinction matters even more now than ever. Open-weight models like Zhipu AI's GLM-5.2 and Moonshot AI's Kimi K3 are starting to close the gap with their frontier counterparts, and these models can reproduce advanced results when paired with a strong agent harness. The capability is no longer limited to a handful of labs with unrestricted access to the latest frontier models. Open-weight models can be leveraged by anyone without the same guardrails or restrictions.

The Hugging Face x OpenAI incident

Take the recent attack on Hugging Face. An OpenAI experimental model escaped its sandbox and autonomously attacked Hugging Face at a speed that was never observed in the wild. Hugging Face, which had to resort to AI to analyse the overwhelming number of events, got stuck because the frontier models' guardrails classified their prompts as potentially harmful. Hugging Face had to resort to an unrestricted open-weight model, GLM 5.2, to process the events and understand the attack. 

There are many things to unpack from the OpenAI x Hugging Face attack, but for the purpose of this essay, the fact they were able to leverage an open-weight model to understand the full impact of the attack means that those models are reaching a level of capability that makes them usable for real-world defence, or offence. The second observation relates to the ability of frontier models to penetrate and move laterally across an organisation without human interaction but simply by following an objective provided by their human operator.

The economics of exploitation are changing

The zero-day market has long depended on secrecy and scarcity. A flaw has value because only a small number of people know it exists. That value changes when AI makes independent discovery more likely. If multiple researchers, vendors or threat actors can scan large codebases, online applications or APIs and reason through exploit paths at machine speed, the useful life of a secret vulnerability becomes shorter. A flaw that might once have been held for months could be discovered by another party much sooner. 

That creates pressure for attackers to move faster. Holding an exploit becomes riskier if someone else may find and disclose or patch the same issue. The incentive shifts toward quicker weaponisation before the opportunity disappears. 

The vulnerability windows is closed

Measuring the time between public vulnerability disclosure to the first detected in-the-wild attack, the mean time to exploit (TTE) has crossed into the red for the first time since 2018. As of July 23, 2026, the Zero Day Clock project reported a mean TTE of -8 hours, highlighting the rapid decline from 21.5 days in 2025 and almost two months in 2024.

Mean time to exploit evolution observed on July 23, 2026 (source: Zero Day Clock)

A negative mean TTE indicates that the majority of vulnerabilities tracked by the Zero Day Clock project are zero-days. This trend is reflected in the zero-day rate that surpassed 80%, meaning that four out of every five exploits detected in the wild were targeting previously unknown or undisclosed vulnerabilities. 

Zero-day rate evolution observed on July 23, 2026  (source: Zero Day Clock)

Defending as the window is closed

Security teams cannot answer machine-speed attacks with human-speed triage alone. Human judgment still matters for understanding business impact, making risk decisions and deciding which systems matter most. The surrounding process has to move faster.

Organisations need accurate asset inventories, current API documentation, clear ownership of exposed systems, control over AI agent deployments and practical ways to discover and prioritise them based on exploitability, risk and business impact. They also need runtime visibility across applications, APIs, bots and AI agents so they can see how systems behave.

AI is helping defenders to reduce noise, connect signals and shorten post-incident investigation time. But to defend in a world where the vulnerability window is closed, reactive security needs to shift to proactive defences, stopping zero-days before they become a post-incident investigation. 

My concluding advice for the past six months used to be that defenders need the ability to understand exposure, prioritise risk and respond before machine-speed discovery became machine-speed exploitation. That advice aged badly! The only option now seems to be for organisations to prioritise proactive defences through red teaming, attack surface management and automated, intent-based protections that can detect attack attempts before a vulnerability is known.