Automated zero-day discovery

A zero-dayZero-day vulnerabilityA security flaw in a program that its maker does not yet know about, so no patch exists. Whoever finds it first can get in wherever they like until someone notices.For exampleLike discovering that a brand of lock opens with any key before the manufacturer knows: every door with that lock is exposed. is a vulnerability nobody has reported yet. Finding them used to be expensive and scarce; the risk is that it stops being so while fixing them goes on costing the same.

The discovery side is documented in real software. As of 22 May 2026, Project Glasswing had reported 23,019 vulnerabilities identified in open-source software; of the 1,752 assessed by that date, 1,587 turned out to be true positives (90.6%) ^[79]Project Glasswing: An initial updateAnthropic · 2026 · institutional blogView source ↗Accessed on 9 September 2026. Google credits Big Sleep with its first twenty vulnerabilities found in open-source software and, earlier, with CVE-2025-6965 in SQLite, a bug the company says was known only to malicious actors ^[460]Google's latest AI security announcementsGoogle · 2025 · institutional blogView source ↗Accessed on 9 September 2026. OpenAI reports that with GPT-5.6-Cyber it found two chainable vulnerabilities in V8 that Google patched as CVE-2026-15903, and clarifies that this model played no part in the Hugging Face incident ^[822]Expanding Daybreak as the Cyber Defense Window NarrowsOpenAI · 2026 · institutional blogView source ↗archived copy onlyAccessed on 9 September 2026. Nor is the offensive use of the capability a hypothesis: on 11 July 2026 agentsAI agentAn AI system that does more than answer: it takes a goal and acts on its own to reach it, step by step, using tools such as a browser, email or a terminal, without anyone approving each step.For exampleAsking an assistant to suggest flights is using a chatbot. Asking it to search, compare, buy the ticket and put it in your calendar, all by itself, is using an agent. exploited two Hugging Face zero-days to the point of obtaining command execution ^[821]The Hugging Face incident and the road aheadOpenAI · 2026 · institutional blogView source ↗archived copy onlyAccessed on 9 September 2026.

The bottleneck is named by the same company that publishes the inventory: fixing depends on human capacity to triage, report and deploy. Of those 23,019, 75 had been patched ^[79]Project Glasswing: An initial updateAnthropic · 2026 · institutional blogView source ↗Accessed on 9 September 2026.

What this does not demonstrate. There is no evidence that the net balance favours the attacker. Andrew Lohn reviewed 57 propositions on the offence-defence balance and concludes that the domain is too multifaceted for a single answer ^[647]The Impact of AI on the Cyber Offense-Defense Balance and the Character of Cyber ConflictLohn, Andrew J. · 2025 · preprintView source ↗Accessed on 9 September 2026; Schneier sharpens the criterion: the advantage depends on whether the system is patchable and the finding verifiable ^[942]What Anthropic's Mythos Means for the Future of CybersecuritySchneier, Bruce · 2026 · webView source ↗Accessed on 9 September 2026. It is also worth not leaning on the most repeated citation: the 87% from Fang et al. is over n = 15 vulnerabilities and with the CVE description supplied; without it, it falls to 7%, and what it measures is implementation, not discovery ^[392]LLM Agents can Autonomously Exploit One-day VulnerabilitiesFang, Richard; Bindu, Rohan; Gupta, Akul et al. · 2024 · preprintView source ↗Accessed on 9 September 2026.